Pin workflow actions and document live-edit script trust (#755)

Pin existing action versions to verified commit SHAs, restrict CI to a read-only repository token, and document the optional live-edit validation script. Preserve required sync/sheriff permissions and existing runtime behavior. Related to #480; extension permission assessment remains separate. AI assistance: Codex, under maintainer direction.
2026-09-11 21:57:14 +03:00 · 2026-09-06 18:04:55 -07:00
parent c4a4f035ed
commit 36e4cea693
6 changed files with 98 additions and 57 deletions
@@ -52,6 +52,7 @@ export const SUITES = {
          'tests/validate-plugin-manifest.test.js',
          'tests/plugin-paths.test.js',
          'tests/release-engine-workflow.test.js',
+          'tests/workflow-security.test.js',
        ],
      },
      {