fix(ci): harden GitHub Actions workflows#400

Open

emptyhammond wants to merge 6 commits into

mainfrom

fix/workflow-security-hardening

Commits on May 20, 2026

fix(ci): harden dependabot-claude-fix.yml against workflow_run + github-app risks
emptyhammond
committed
fix(ci): harden dependabot-lockfile.yml against pull_request_target + github-app risks
emptyhammond
committed
fix(ci): scope GitHub App tokens in claude-review.yml and pr-overview.yml
emptyhammond
committed
fix(ci): pin 25 actions to SHA and scope permissions in e2e-web-cli-parallel.yml
emptyhammond
committed
fix(ci): prevent cache poisoning and pin actions in release workflows
emptyhammond
committed
fix(ci): pin actions to SHA in audit.yml, e2e-tests.yml, and test.yml
emptyhammond
committed