Pin and review actions

Critical external actions are pinned to reviewed immutable commits and updated through a controlled dependency review. This is a small part of a GitHub repository whose workflow tests, builds, packages, and deploys a small site through a protected environment, but the boundary it creates affects everything that follows.

An action can run arbitrary code inside the job, so mutable tags and unknown maintainers create supply-chain risk. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

Watch for one shortcut in particular: trying to reference a convenient moving tag and grant the job broad permissions. It makes later failures harder to locate. Instead, minimize external actions, review source and ownership, pin immutable revisions, and update with evidence. Prefer an implementation you can explain from the outside before optimizing it.

Keep the wider goal in view: Reduce workflow authority and prevent untrusted repository input from becoming privileged code execution. A short observation with concrete evidence is more useful than a confident sentence with no reproduction path.

List every action in the workflow, its pin, maintainer, permissions, inputs, and update process. Hand the result to someone else and see whether the behavior is clear without an oral explanation.