Ivan Pereira a24b4e5b05 ci: harden workflows against token exfiltration ...

Disable checkout credential persistence so repository-controlled code
run by npm ci/test cannot read GITHUB_TOKEN from .git/config, and pin
actions to full commit SHAs to guard against mutable-tag supply-chain
attacks.

2026-07-14 12:42:55 +01:00

..

ci.yml

ci: harden workflows against token exfiltration

2026-07-14 12:42:55 +01:00

npm-publish.yml

ci: harden workflows against token exfiltration

2026-07-14 12:42:55 +01:00