Pin existing action versions to verified commit SHAs, restrict CI to a read-only repository token, and document the optional live-edit validation script. Preserve required sync/sheriff permissions and existing runtime behavior. Related to #480; extension permission assessment remains separate.
AI assistance: Codex, under maintainer direction.
Make policy and merge-conflict blockers age as contributor work, keep maintainer-policy decisions out of ready state, auto-close regular contributors unless explicitly exempted, and mark new or reopened issues for triage.
AI-assisted change: implemented and validated by Codex under maintainer direction.
Upgrade actions/setup-node to v7 across CI, sheriff, and generated-output sync workflows.
The action migrated to ESM and updated its cache internals; existing inputs required no migration. The PR's full exercised CI matrix passed on v7, and all changed workflows passed local YAML validation.
AI assistance: Codex performed dependency review and validation under maintainer automation instructions.
Paul BakausandGitHub
dependabot[bot]andGitHub