dde00d0d8c
Add per-call OAuth scope resolution for workflow paths and reject unsafe repository-relative paths before file writes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>