bun-ecosystem-ci

Pins to at workflow scope. Both jobs (, ) only check out the repo, install bun, then run + ///. No GitHub API write. Defense-in-depth motivation is CVE-2025-30066 on : a compromised third-party action runs inside the existing job context and exfiltrates the workflow via build logs. is third-party here, so the cap is meaningful. YAML validated locally with .

Each of these workflows runs without a top-level block, so its inherits the repository (or org) default, which is frequently read/write for all scopes. Setting explicitly on keeps the workflow token scoped to what the job actually uses. If a third-party action or transitive dependency in the run were ever compromised, a read-only token limits the damage (no pushes, no releases, no token-backed writes). The change is mechanical and does not alter any step.