)]}'
{
  "commit": "c6d1f601c9fc86b562640ed5fc73b320700d7aee",
  "tree": "6a3b8796b40f9fc2691ec5c713808fd1c669dda1",
  "parents": [
    "679dac3725b2d31c841e5180afdfa88a7e8cd8e5"
  ],
  "author": {
    "name": "Jarek Potiuk",
    "email": "jarek@potiuk.com",
    "time": "Tue Sep 15 22:33:33 2026 +0200"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Tue Sep 15 22:33:33 2026 +0200"
  },
  "message": "fix(dev): grant the bump workflow\u0027s calling jobs the permissions their callees need (#1237)\n\nThe workflow did not start:\n\n    The nested job \u0027prek\u0027 is requesting \u0027contents: read\u0027,\n    but is only allowed \u0027contents: none\u0027.\n\nA called workflow\u0027s jobs may request at most what the *calling* job was\ngranted, and `permissions: {}` at the top of this file grants the four `uses:`\njobs nothing at all. Each now carries a block mirroring exactly what its\ncallee\u0027s jobs declare — `contents: read` for prek, tests and rat, plus\n`actions: read` for zizmor, whose API-backed audits need it. Mirroring rather\nthan granting a blanket `read-all` matters: widening one here would silently\nwiden what a called check can reach.\n\nThese four are every reusable-workflow call in the repository; nothing else\n`uses:` a local workflow.\n\nAlso fixes a branch leak found while auditing the rest of the file for the same\nclass of problem. `prepare` published its `branch` output at the end of the\nstep, after the commit mutation — so a failed mutation left the candidate branch\ncreated but unnamed in `needs`, and `cleanup` skipped it. The output now lands\nimmediately after the ref is created, which is the point from which there is\nsomething to clean up.\n\nGenerated-by: Claude Opus 5",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "8b7159e05f8340c71d653f43cbbc4b1b24114b9c",
      "old_mode": 33188,
      "old_path": ".github/workflows/bump-dev-version.yml",
      "new_id": "171f7916cbc05ed54b2ff99ae580d8c0e5dcf0ec",
      "new_mode": 33188,
      "new_path": ".github/workflows/bump-dev-version.yml"
    }
  ]
}