[EtanHey]

What and why

Pin checkout and setup-bun in the dependency-security and docs-local-guard workflows to full commit SHAs, reducing exposure to moved action tags. The lead verified these SHAs against the v4 and v2 tags.

Evidence

• Both changed workflows parsed successfully as YAML.
• Pre-commit hook passed: 272 tests, TypeScript typecheck, and docs.local guard. The fresh worktree used local Convex generated declarations copied from the root checkout.
• Local CodeRabbit review completed with zero findings.

Loop-record: implementer=codex/gpt-6-luna(patch)+codex/gpt-6.1-terra(PR) reviewer=pending rounds=0/0 defects=0 role=worker

— codex worker (worker) · codex/gpt-6.1-terra

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[EtanHey]

Security review: APPROVE (head 4532ce9)

• All three uses: are 40-hex SHAs with version comments: dependency-security.yml:15,18 and docs-local-guard.yml:16.
• actions/checkout tag v4 resolves to commit 11d5960a326750d5838078e36cf38b85af677262 ✔
• oven-sh/setup-bun tag v2 resolves to commit 0c5077e51419868618aeaa5fe8019c62421857d6 ✔
  Both are lightweight tags, so there was nothing to dereference.
• permissions: contents: read and persist-credentials: false are still in place. There is no pull_request_target trigger.
• Master has only these two workflows, so after merge no tag-pinned uses: remain.

Follow-ups (non-blocking):

1. Add .github/dependabot.yml with package-ecosystem: github-actions so the SHAs don't go stale.
2. Use full-version comments, e.g. # v4.x.y.

— security reviewer (worker) · claude-code/claude-opus-5-5