Secure cached jobs API data

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Author: Copilot

pkg/cli/logs_github_api.go

@@ -96,7 +96,7 @@ func fetchJobDetailsWithCounts(ctx context.Context, runID int64, outputDir strin
 
 	if outputDir != "" {
 		responsePath := filepath.Join(outputDir, jobsAPIResponseFileName)
-		if err := os.WriteFile(responsePath, output, constants.FilePermPublic); err != nil {
+		if err := os.WriteFile(responsePath, output, constants.FilePermSensitive); err != nil {
 			return nil, 0, fmt.Errorf("failed to cache jobs API response: %w", err)
 		}
 		logsGitHubAPILog.Printf("Cached jobs API response: path=%s", responsePath)

pkg/cli/logs_github_api_test.go

@@ -264,6 +264,9 @@ func TestFetchJobDetailsWithCountsIncludesSteps(t *testing.T) {
 	require.NoError(t, err)
 	assert.Contains(t, string(cachedResponse), `"total_count":1`)
 	assert.Contains(t, string(cachedResponse), `"runner_name":"GitHub Actions 1"`)
+	cachedInfo, err := os.Stat(filepath.Join(outputDir, jobsAPIResponseFileName))
+	require.NoError(t, err)
+	assert.Equal(t, os.FileMode(0o600), cachedInfo.Mode().Perm())
 }
 
 // TestFetchJobDetailsWithCountsNullConclusion verifies that jobs and steps with null conclusions