Pin cached Gitea workflow actions

2026-09-04 03:43:31 -04:00
parent 4104b921f2
commit 485cb08b71
8 changed files with 37 additions and 10 deletions
@@ -88,6 +88,10 @@ staging branch:
  fixed host and port reachable from job containers, avoiding the timeout caused
  by its former auto-detected private address. Warm jobs reuse dependency
  tarballs without caching `node_modules`.
+- All external workflow actions are pinned to reviewed commit SHAs. The runner
+  may therefore set `cache.offline_mode: true` and reuse its local action
+  repository cache without trusting a mutable tag or refreshing GitHub on every
+  job.

 The pilot dependencies were verified on `cms-pilot`. The same protection rules
 apply to `cms`; its exact-origin CORS and OAuth values are the remaining