Harden actions against script injection and pin third-party actions#28

Merged

MAfarrag merged 16 commits into

mainfrom

security-hardening

Jul 21, 2026

Commits on Jul 21, 2026

test(mkdocs-deploy): assert tag presence flips release success/failure
MAfarrag
committed
ci(deploy-docs): drop unused pages: write permission
MAfarrag
committed
ci(test-release-github): note contents: read relies on skip-github-release
MAfarrag
committed
style(mkdocs-deploy): add trailing newline at end of file
MAfarrag
committed
fix(release/github): env-scope caller inputs in run blocks to close injection (SEC-8)
MAfarrag
committed
fix(release/github): env-scope step outputs re-interpolated into run bodies
MAfarrag
committed
feat(release/github)!: make install-groups required and drop the default
MAfarrag
committed
Merge branch 'main' of github.com:Serapieum-of-alex/github-actions into security-hardening
MAfarrag
committed
feat(release/github): fail fast with a clear error when commitizen is unavailable
MAfarrag
committed
docs(release/github): reflect required install-groups (no default) in inputs tables
MAfarrag
committed
fix(release/github): run the commitizen preflight from WORK_DIR and surface its error
MAfarrag
committed
docs(release/github): add required install-groups to all examples
MAfarrag
committed