Pin cached Gitea workflow actions

docs/decap-cms-gitea-setup.md

@@ -29,6 +29,27 @@ If Cloudflare later assigns a different stable origin,
 update the repository configuration, CORS origin, and OAuth redirect URI
 together through review before enabling login.
 
+## Runner cache settings
+
+The Dockerized runner uses a persistent `/data` volume and the same dedicated
+Docker network as its job containers. Its non-confidential cache settings are:
+
+```yaml
+cache:
+  enabled: true
+  dir: /data/cache
+  host: sloanops-gitea-runner
+  port: 8088
+  offline_mode: true
+container:
+  network: sloanops-actions
+```
+
+`offline_mode` is safe here because every external `uses:` reference is pinned
+to a reviewed full commit SHA. It prevents the runner from refreshing mutable
+action branches on every job; npm packages remain keyed separately by
+`package-lock.json` through setup-node's cache integration.
+
 ## Applied CORS policy
 
 The tracked Gitea service in

docs/decap-cms-pilot.md

@@ -88,6 +88,10 @@ staging branch:
   fixed host and port reachable from job containers, avoiding the timeout caused
   by its former auto-detected private address. Warm jobs reuse dependency
   tarballs without caching `node_modules`.
+- All external workflow actions are pinned to reviewed commit SHAs. The runner
+  may therefore set `cache.offline_mode: true` and reuse its local action
+  repository cache without trusting a mutable tag or refreshing GitHub on every
+  job.
 
 The pilot dependencies were verified on `cms-pilot`. The same protection rules
 apply to `cms`; its exact-origin CORS and OAuth values are the remaining