test(e2e): cover git-refs backend on push + assert no v1 branch #90

	name: CodeQL (GitHub Actions)
	on:
	workflow_dispatch:
	pull_request:
	paths:
	- '.github/workflows/**'
	- '.github/actions/**'

	permissions: {}

	jobs:
	analyze:
	name: Analyze workflows
	runs-on: ubuntu-latest

	permissions:
	actions: read
	contents: read
	security-events: write

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	ref: ${{ github.event.pull_request.head.sha }}

	- name: Initialize CodeQL
	uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
	with:
	languages: actions
	queries: security-extended,security-and-quality

	- name: Perform CodeQL analysis
	uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
	with:
	category: /language:actions
	# Fork PRs receive a read-only GITHUB_TOKEN, so SARIF upload to the
	# code-scanning API would fail. Analyze still runs and surfaces
	# findings in the job log; same-repo PRs upload as normal.
	upload: ${{ github.event.pull_request.head.repo.full_name == github.repository && 'always' \|\| 'never' }}

Provide feedback