Pin workflow actions and document live-edit script trust

Resolve the existing action tags to full commit SHAs, keep CI repository access read-only, and document the optional project validation command. Preserve existing sync/sheriff write permissions and avoid runtime permission prompts or extension changes. AI assistance: Codex, under maintainer direction.
2026-09-18 00:56:30 +03:00 · 2026-09-06 17:29:19 -07:00
parent c4a4f035ed
commit 378918745e
6 changed files with 98 additions and 57 deletions
@@ -52,6 +52,7 @@ export const SUITES = {
          'tests/validate-plugin-manifest.test.js',
          'tests/plugin-paths.test.js',
          'tests/release-engine-workflow.test.js',
+          'tests/workflow-security.test.js',
        ],
      },
      {