Sam Limbu ba425e8a87 SEC-01: pin actions/checkout in the deploy workflow to a commit SHA ... deploy.yml runs on the self-hosted VPS runner with passwordless sudo, so a mutable tag on this action is a code-execution path onto that host if the tag is ever moved. Pinned to the commit v4 currently resolves to (11d5960a326750d5838078e36cf38b85af677262), verified against upstream — this is the same code the deploy already runs today, not a version bump. ci.yml is on v7.0.1; the deploy path is deliberately left on v4 so that pinning does not smuggle a major-version change into a workflow whose only test is a live deploy. Raised by Codex review of PR #5 as the one unpinned `uses:` in either workflow. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>		2026-08-27 22:42:29 +10:00
..
workflows	SEC-01: pin actions/checkout in the deploy workflow to a commit SHA	2026-08-27 22:42:29 +10:00