From c2ae1361cc5be84b79fbb989cae74037a6531435 Mon Sep 17 00:00:00 2001
From: Tom Elizaga <tom.elizaga@gmail.com>
Date: Fri, 12 Jun 2026 14:20:22 -0700
Subject: [PATCH 1/2] Run CI on fork pull requests

---
 .github/workflows/lint.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 5c4187a..7ea0886 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -10,7 +10,6 @@ permissions: read-all
 
 jobs:
   shellcheck:
-    if: ${{ github.event.pull_request == null || github.event.pull_request.head.repo.full_name == github.repository }}
     name: ShellCheck
     runs-on: ubuntu-latest
     steps:
@@ -24,7 +23,6 @@ jobs:
           shellcheck bin/gtr bin/git-gtr lib/*.sh lib/commands/*.sh adapters/editor/*.sh adapters/ai/*.sh
 
   completions:
-    if: ${{ github.event.pull_request == null || github.event.pull_request.head.repo.full_name == github.repository }}
     name: Completions
     runs-on: ubuntu-latest
     steps:
@@ -34,7 +32,6 @@ jobs:
         run: ./scripts/generate-completions.sh --check
 
   test:
-    if: ${{ github.event.pull_request == null || github.event.pull_request.head.repo.full_name == github.repository }}
     name: Tests
     runs-on: ubuntu-latest
     steps:

From f6d83547c0b259b7e9b1d13bf614004ec8739d32 Mon Sep 17 00:00:00 2001
From: Tom Elizaga <tom.elizaga@gmail.com>
Date: Wed, 12 Aug 2026 10:00:48 -0700
Subject: [PATCH 2/2] fix(ci): minimize fork pull request permissions

---
 .github/workflows/lint.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 7ea0886..eb2c8dd 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -6,7 +6,8 @@ on:
   pull_request:
     branches: [main]
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   shellcheck:
@@ -14,6 +15,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - name: Install ShellCheck
         run: sudo apt-get update && sudo apt-get install -y shellcheck
@@ -27,6 +30,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - name: Verify completion files are up to date
         run: ./scripts/generate-completions.sh --check
@@ -36,6 +41,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - name: Install BATS
         run: sudo apt-get update && sudo apt-get install -y bats