* Stop using floating Python 3.x in docs and label_pr CI
The python-version: '3.x' specifier resolved to Python 3.15.0 on newer
runner images, causing rpds-py to fail to build (no pre-built wheel).
Removing the override lets the setup-python composite action derive the
version from the Makefile, consistent with the rest of CI.
* Fix SonarCloud security findings in docs and label_pr workflows
Pin pip dependencies with --only-binary :all: to prevent execution of
setup scripts, scope write permissions to job level instead of workflow
level, and use full commit SHA for third-party action.
* fix yaml syntax
* update yaml syntax so all run is recongnized correctly
* Add least-privilege permissions to docs workflow
* Disable credential persistence in docs workflow checkout
Prevents tox and dependency code from accessing the GitHub token
stored in .git/config.
Assisted-By: Claude Opus 4.6 <noreply@anthropic.com>
* AAP-96178: Fix unified_jobs pagination count to respect RBAC filtering
Non-admin users saw the unfiltered table-wide count instead of the count
matching their RBAC-visible results. Use the same primary-key subquery
approach already proven on the /api/v2/jobs/ endpoint.
* AAP-96178: Add docstrings and mixed-role count test for UnifiedJobPaginator
Clarify the PK subquery approach with expanded docstring and inline
comments per review feedback. Add a functional test verifying that a user
with a mix of JT and inventory roles sees a count matching exactly
their permitted results.
* AAP-96178: Add deduplication test for multiple RBAC access routes
Verify that a job reachable through three overlapping permission paths
(direct JT role, org audit role, and team JT role) appears exactly once
in both results and count.
Assisted-By: Claude Opus 4.6 <noreply@anthropic.com>
Jake Jackson