From d725b678f9b9f23d9214c5b14c7b542feb31cbce Mon Sep 17 00:00:00 2001
From: Sayt0 <138035894+Sayt-0@users.noreply.github.com>
Date: Wed, 5 Aug 2026 16:56:29 +0200
Subject: [PATCH] fix(ci): run release safeguard test in unprivileged workflow

Move the PR-controlled shell test out of the workflow_run context and into the pull_request test workflow to resolve the CodeQL untrusted-checkout finding introduced by #76.
---
 .github/workflows/test-e2e.yml | 21 ---------------------
 .github/workflows/test.yml     |  3 +++
 2 files changed, 3 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/test-e2e.yml b/.github/workflows/test-e2e.yml
index f6210f0..c538e59 100644
--- a/.github/workflows/test-e2e.yml
+++ b/.github/workflows/test-e2e.yml
@@ -63,27 +63,6 @@ jobs:
           chmod +x test-job-summary.sh
           ./test-job-summary.sh
 
-  test-release-caller-permissions:
-    name: Release Caller Permissions Tests
-    runs-on: ubuntu-latest
-    if: |
-      github.event_name == 'push' ||
-      github.event_name == 'workflow_dispatch' ||
-      github.event.workflow_run.conclusion == 'success'
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || '' }}
-
-      - name: Run release caller-permissions tests
-        run: |
-          cd tests
-          chmod +x test-release-caller-permissions.sh
-          ./test-release-caller-permissions.sh
-
   resolve-context:
     name: Resolve PR Context
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 78ee366..e581aa0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -71,6 +71,9 @@ jobs:
       - name: Run unit tests
         run: pnpm test
 
+      - name: Run release caller-permissions tests
+        run: ./tests/test-release-caller-permissions.sh
+
   integration-test:
     name: Integration Tests
     permissions: