Tighten external plugin PR workflow permissions

Scope write permissions to the PR synchronization job, keep the quality-gate job read-only, and handle no-op and detection-failure states explicitly. Also fix source tree link encoding for refs, SHAs, and plugin paths.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Aaron Powell
2026-06-16 13:39:14 +10:00
parent 83f7cc37a8
commit 351221bb9c
2 changed files with 8 additions and 5 deletions
+1 -1
View File
@@ -28,7 +28,7 @@ export function buildSourceTreeUrl(plugin) {
return `https://github.com/${sourceRepo}`;
}
const encodedLocator = encodePathLikeValue(sourceLocator);
const encodedLocator = encodeURIComponent(sourceLocator);
const normalizedPath = normalizePluginPath(plugin?.source?.path);
if (!normalizedPath) {
return `https://github.com/${sourceRepo}/tree/${encodedLocator}`;