syntaqxA workspace token for all of its workspace's repositories is held to that workspace. Identity resolved such a token with no reach (only a token for chosen repositories had one), so the API's resource-owner check never applied to it: with issues or pull-requests write it could open issues, comment or open pull requests on any other workspace's public repository as the workspace, which the docs said it could not. apply_reach now gives every workspace token a reach of its own workspace, all of its repositories or the ones chosen (workspace_token_reach), the shape a person's token made for one workspace already has; outside it, it reads public repositories as anyone may and changes nothing (token:resource-owner). Inside its workspace nothing changes. Checked: cargo test -p g1t-identity --lib (177, new: a workspace token never writes outside its workspace, for all or chosen repositories; one for all covers its own repositories only) and its wasm32 check.b235b5eHistory
- ..
- coordination
- authored.rs
- checks.rs
- codeowners.rs
- commit_checks.rs
- contributions.rs
- decisions.rs
- ghost.rs
- guardrails.rs
- inbox.rs
- insights.rs
- insights.sql
- integration.rs
- labels.rs
- lib.rs
- lifecycle.rs
- mergeability.rs
- milestones.rs
- prefetch.rs
- queue.rs
- queue_tests.rs
- retired.rs
- reviews.rs
- rows.rs
- rulesets.rs
- runs.rs
- settings.rs
- statuses.rs
- team_reviews.rs