eslint-plugin-github-actions-2 1.0.4 → 1.0.6

package/docs/rules/require-workflow-permissions.md

@@ -43,10 +43,9 @@ jobs:
     runs-on: ubuntu-latest
 ```
 
-
 ## Additional examples
 
-For larger repositories, this rule is often enabled together with one of the published presets so violations are caught in pull requests before workflow changes are merged.
+For larger repositories, this rule works well as a baseline requirement for explicit token scope. If your team prefers every job to declare permissions locally, layer the opt-in `no-top-level-permissions` rule on top.
 
 ## ESLint flat config example
 
@@ -69,7 +68,8 @@ export default [
 ## When not to use it
 
 You can disable this rule when its policy does not match your repository standards, or when equivalent enforcement is already handled by another policy tool.
+
 ## Further reading
 
-- [https://docs.github.com/actions/reference/workflows-and-actions/workflow-syntax#permissions](https://docs.github.com/actions/reference/workflows-and-actions/workflow-syntax#permissions)
-- [https://docs.github.com/actions/security-for-github-actions/security-guides/automatic-token-authentication](https://docs.github.com/actions/security-for-github-actions/security-guides/automatic-token-authentication)
+- [GitHub Actions workflow syntax: permissions](https://docs.github.com/actions/reference/workflows-and-actions/workflow-syntax#permissions)
+- [GitHub Actions automatic token authentication guide](https://docs.github.com/actions/security-for-github-actions/security-guides/automatic-token-authentication)

package/package.json

@@ -1,7 +1,7 @@
 {
     "$schema": "https://www.schemastore.org/package.json",
     "name": "eslint-plugin-github-actions-2",
-    "version": "1.0.4",
+    "version": "1.0.6",
     "private": false,
     "description": "ESLint plugin for GitHub Actions workflow quality, reliability, and security rules.",
     "keywords": [