fix(ci): restrict thermos service isolation secrets
loading diff…
pull_request and exposed DOPPLER_TOKEN_THERMOS_DEV at job scope, allowing PR-controlled code to run with Doppler-injected secrets and creating a secret-exposure risk.pull_request trigger so the workflow only runs on trusted push branches and workflow_dispatch (file: .github/workflows/thermos_service_isolation_tests.yml).pull-requests: write permission and left contents: read for the job to reduce privileges.DOPPLER_TOKEN_THERMOS_DEV from job-level env into the single Run Service Isolation Tests step so the secret is only available for the one command that needs it (file: .github/workflows/thermos_service_isolation_tests.yml).python - <<'PY' ... PY) that confirmed the workflow no longer contains a pull_request trigger and that DOPPLER_TOKEN_THERMOS_DEV is not present before the steps block, and it passed.git diff --check which passed without errors.fix(ci): restrict thermos service isolation secrets (commit present in branch).