v1.91.16.0 fix: safe installs and upgrades, skills start everywhere, truthful completion (parallel wave) (#3014)

* fix(make-pdf,design): real TOC page numbers and anchors; design models move to gpt-5.5 + gpt-image-2 (#2903, #2807)

* ci: pin every action to a SHA, Scorecard, checksummed Bun, scoped Codex CLI in the CI image, macOS named-regressions job (#1948, #1706, #1997)

* fix(cso,browse): Windows/macOS lease identity, retention skips bad runs, truthful 'not assessed' reports, env.kv false positive, Windows browse spawn fixes (#2894, #2912, #2048, #2637, #2805)

* fix(outside-voice): one Codex model precedence for probe and dispatch, bounded timeouts with KILL escalation, probe cache identity, guarded mktemp, skills hidden in nested Codex (#2776, #2914, #2787, #2881, #2847)

* feat(setup): install registry, ./setup --status, staged activation, per-scope migrations, host tiers and conformance kit, OpenCode/Hermes fixes, Copilot CLI (experimental), disabled_skills, slimmer CLAUDE.md (#1925, #2879, #2347, #2338, #2626, #2629, #2825, #2015, #393, #1206, #2096)

Co-authored-by: Andrey Esipov <61357035+andrey-esipov@users.noreply.github.com>
Co-authored-by: Matthew Williams <5863886+ridermw@users.noreply.github.com>
Co-authored-by: Rocky Wu <92764750+lolisaigao1234@users.noreply.github.com>

* fix(preamble): skills start in worktree-isolated Claude Code sessions — one literal skill-start line, context-recovery helper, no eval in skill blocks, $N token tripwire, honest plan-mode precedence (#2763, #2896, #2851)

* fix(setup): per-install renders for renamed, vendored and custom-config installs, space-safe alias roots, per-host /cso launcher path (#1882, #2906)

* test: free tests never write the real HOME (home-write tripwire), no orphaned browse daemons, symlinked-TMPDIR (macOS) fixes, gbrain-on-PATH isolation (#2895, #2816, #2829, #2841, #2982, #2911, #2909, #2908, #2910)

* chore: integrate wave follow-ups — regenerate all hosts, README model docs, TODOS, touchfiles, duration seeds, Bun 1.3 telemetry test fix, replay fixtures pinned to their recorded bytes

* v1.91.14.0: release metadata

* test(browse): group-kill cleanup falls back to the leader when macOS returns EPERM for a live group

* ci: Codex login steps run under bash (the CI container's default sh rejects pipefail)

* fix: full-suite repairs — private state roots for 7 real-HOME writers, truthful home-guard attribution with --attribute-home, gstack-paths shim in ship-hook fixtures, Copilot in team-init probes, test-of-test detector, cookie review fixture pinned to the approved excerpt

* fix(windows): LF for Dockerfiles, normalized home-guard exclusions, path.relative fixture containment, ship push test spawn timeouts

* test(design-detect): widen the whole-scan budget test's timing margins so a loaded macOS runner can't time out the single-batch call

* fix(evals): qa protocol names defined for the judge, async PTY judge so overlapping sessions keep their cleanup deadline, bws setup cases use the standard JUDGE_MS tier

* test(pty): the non-blocking judge case is POSIX-only (its fake judge is a shebang script, like the PTY harness it covers)

* test(evals): ship-coverage-audit names absolute skill paths, uses Read, and skips the Step 7 artifact nothing consumes (removes the mechanism behind 3 of 4 historical timeouts)

* test: deflake terminal-agent concurrent startup (write the placeholder record before spawning, like the product) and qa-evidence resumed pipe (barrier on a full high-water mark instead of a sleep)

* fix(design): daemon log stream handles open errors instead of crashing the daemon; shutdown test awaits the stubbed exit

* test(evals): skillify checks the product's resolved state root (no GSTACK_HOME bypass), negative cases check every root; tpa shims live outside the agent's cwd and answer consistently

* test(evals): coverage-audit detector splits parallel columns at │ rails and [+] groups; coverage prompts name absolute skill paths; TODOs from the gate eval census

* fix(plan-eng-review): scope gate always sends the menu (no headless 'Scope pending' exit); PTY harness ends idle turn-ends and API-error panels promptly with a precise diagnostic

* test(evals): one position-bound coverage-read rule credits read-only && chains (labels, context ranges, git displays in either order) and still rejects forged output

* fix(ship): documentation section has one saved source inserted by cat (never retyped); spawned-marker evidence is the child output; refreshed codex/factory ship goldens

* test(docsync): the byte-exact insert positive is POSIX-only (the bash-command observer refuses backslash paths by design)

* test(evals): plan-design-with-ui focus-title rule accepts the comma-less 'dimensions or focus' wording (replayed on the captured CI run, negative controls kept)

* fix(qa-callers): exploratory preflight says the scope/method Reads come after exploratory.md; design-review scan check credits an executed scan proven by one engine run over the changed files

---------

Co-authored-by: Andrey Esipov <61357035+andrey-esipov@users.noreply.github.com>
Co-authored-by: Matthew Williams <5863886+ridermw@users.noreply.github.com>
Co-authored-by: Rocky Wu <92764750+lolisaigao1234@users.noreply.github.com>

.github/docker/Dockerfile.ci

@@ -77,13 +77,27 @@ RUN curl --retry 5 --retry-delay 5 --retry-connrefused -fsSL "https://nodejs.org
     && npm --version
 
 # Bun (install to /usr/local so non-root users can access it).
-# The version MUST be passed as a positional arg — bun.sh/install ignores a
-# BUN_VERSION env var, so the old `| BUN_VERSION=x.y.z bash` form silently
-# installed latest on every image rebuild (observed: 1.3.13/1.3.14 drift vs
-# the 1.3.10 devs ran locally).
+# The exact release archive, verified by SHA-256 before it is unpacked
+# (#1706). The old `curl https://bun.sh/install | bash -s bun-vX.Y.Z` ran
+# whatever script the network served at build time, and before that the
+# `| BUN_VERSION=x.y.z bash` form silently installed latest on every rebuild.
+# Hashes come from the release's SHASUMS256.txt. The image builds linux/amd64
+# only (the Node.js tarball above is linux-x64); an architecture without a
+# verified archive fails here. test/ci-image-cli-pin.test.ts pins this shape.
+ARG BUN_VERSION=1.4.0
+ARG TARGETARCH
 ENV BUN_INSTALL="/usr/local"
-RUN curl --retry 5 --retry-delay 5 --retry-connrefused -fsSL https://bun.sh/install \
-    | bash -s "bun-v1.4.0"
+RUN case "${TARGETARCH:-amd64}" in \
+      amd64) bun_target=linux-x64; bun_sha256=2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452 ;; \
+      *) echo "Dockerfile.ci: no verified Bun ${BUN_VERSION} archive for ${TARGETARCH}" >&2; exit 1 ;; \
+    esac \
+    && curl --retry 5 --retry-delay 5 --retry-connrefused -fsSL \
+      "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-${bun_target}.zip" -o /tmp/bun.zip \
+    && echo "${bun_sha256}  /tmp/bun.zip" | sha256sum -c - \
+    && unzip -q /tmp/bun.zip -d /tmp/bun \
+    && install -D -m 0755 "/tmp/bun/bun-${bun_target}/bun" "${BUN_INSTALL}/bin/bun" \
+    && rm -rf /tmp/bun /tmp/bun.zip \
+    && test "$(bun --version)" = "${BUN_VERSION}"
 
 # Claude CLI — pinned to an EXACT version, same discipline as the bun pin
 # above. The PTY harness (test/helpers/claude-pty-runner.ts) screen-scrapes
@@ -102,6 +116,19 @@ RUN curl --retry 5 --retry-delay 5 --retry-connrefused -fsSL https://bun.sh/inst
 # its SDK-only judge evals, which never start this CLI, were 25% slower too.
 RUN npm i -g @anthropic-ai/claude-code@2.1.284
 
+# Codex CLI — exact pin, same discipline as the claude pin above, so the
+# Codex eval files execute in CI instead of self-skipping. Installed OFF PATH:
+# a skill's outside-voice probe (`command -v codex`) must keep reporting
+# not_installed in every other paid case. The paid shard runner puts this
+# directory on PATH only for the Codex files (scripts/lib/paid-cases.ts scopeCodexAccess).
+# The image carries no credential: the eval workflows run `codex login
+# --with-api-key` from the OPENAI_API_KEY secret in same-repo runs only
+# (codex 0.160.0 does not read OPENAI_API_KEY from the environment).
+ENV GSTACK_CI_CODEX_BIN_DIR=/opt/codex/bin
+RUN npm i -g --prefix=/opt/codex @openai/codex@0.160.0 \
+    && test -x /opt/codex/bin/codex \
+    && ! command -v codex
+
 # Playwright system deps (Chromium) — needed for browse E2E tests
 RUN npx playwright install-deps chromium
 
@@ -144,7 +171,7 @@ RUN npx playwright install chromium \
     && chmod -R a+rX /opt/playwright-browsers
 
 # Verify everything works
-RUN bun --version && node --version && claude --version && jq --version && gh --version \
+RUN bun --version && node --version && claude --version && /opt/codex/bin/codex --version && jq --version && gh --version \
     && python3 --version && command -v file && command -v pdftotext && command -v pdffonts && command -v pdfinfo \
     && npx playwright --version \
     && fc-match "Liberation Sans" | grep -qi "Liberation" \

.github/workflows/actionlint.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubicloud-standard-2
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       # Pull the prebuilt image instead of rhysd/actionlint@v1.7.11 (a Docker

.github/workflows/dependency-review.yml

@@ -23,7 +23,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with:
           fail-on-severity: high

.github/workflows/evals-marathon.yml

@@ -172,6 +172,30 @@ jobs:
           name: marathon-plan
           path: /tmp/marathon-plan
 
+      # The image ships the pinned Codex CLI off PATH and without a
+      # credential; codex does not read OPENAI_API_KEY from the environment.
+      # Log it in from the secret (same-repo runs only) under a non-default
+      # home. The shard runner hands that home and the CLI to the Codex files
+      # only (scripts/lib/paid-cases.ts scopeCodexAccess); every other paid case sees no
+      # Codex, as before. Without a key the Codex cases fail; they never pass.
+      - name: Authenticate the Codex CLI
+        shell: bash
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        run: |
+          set -euo pipefail
+          codex="${GSTACK_CI_CODEX_BIN_DIR:?}/codex"
+          export CODEX_HOME="$HOME/.gstack-ci-codex"
+          mkdir -p "$CODEX_HOME"
+          echo "GSTACK_CI_CODEX_HOME=$CODEX_HOME" >> "$GITHUB_ENV"
+          if [ -z "${OPENAI_API_KEY:-}" ]; then
+            echo "::warning::OPENAI_API_KEY is unavailable; Codex eval cases cannot authenticate and will fail."
+            exit 0
+          fi
+          printenv OPENAI_API_KEY | "$codex" login --with-api-key
+          "$codex" login status >/dev/null 2>&1
+
       - name: Run marathon slice ${{ matrix.slice }}
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

.github/workflows/evals-periodic.yml

@@ -206,6 +206,30 @@ jobs:
           name: paid-plan
           path: /tmp/paid-plan
 
+      # The image ships the pinned Codex CLI off PATH and without a
+      # credential; codex does not read OPENAI_API_KEY from the environment.
+      # Log it in from the secret (same-repo runs only) under a non-default
+      # home. The shard runner hands that home and the CLI to the Codex files
+      # only (scripts/lib/paid-cases.ts scopeCodexAccess); every other paid case sees no
+      # Codex, as before. Without a key the Codex cases fail; they never pass.
+      - name: Authenticate the Codex CLI
+        shell: bash
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        run: |
+          set -euo pipefail
+          codex="${GSTACK_CI_CODEX_BIN_DIR:?}/codex"
+          export CODEX_HOME="$HOME/.gstack-ci-codex"
+          mkdir -p "$CODEX_HOME"
+          echo "GSTACK_CI_CODEX_HOME=$CODEX_HOME" >> "$GITHUB_ENV"
+          if [ -z "${OPENAI_API_KEY:-}" ]; then
+            echo "::warning::OPENAI_API_KEY is unavailable; Codex eval cases cannot authenticate and will fail."
+            exit 0
+          fi
+          printenv OPENAI_API_KEY | "$codex" login --with-api-key
+          "$codex" login status >/dev/null 2>&1
+
       - name: Run periodic slice ${{ matrix.slice }}
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -306,6 +330,30 @@ jobs:
           name: gate-census-plan
           path: /tmp/gate-census-plan
 
+      # The image ships the pinned Codex CLI off PATH and without a
+      # credential; codex does not read OPENAI_API_KEY from the environment.
+      # Log it in from the secret (same-repo runs only) under a non-default
+      # home. The shard runner hands that home and the CLI to the Codex files
+      # only (scripts/lib/paid-cases.ts scopeCodexAccess); every other paid case sees no
+      # Codex, as before. Without a key the Codex cases fail; they never pass.
+      - name: Authenticate the Codex CLI
+        shell: bash
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        run: |
+          set -euo pipefail
+          codex="${GSTACK_CI_CODEX_BIN_DIR:?}/codex"
+          export CODEX_HOME="$HOME/.gstack-ci-codex"
+          mkdir -p "$CODEX_HOME"
+          echo "GSTACK_CI_CODEX_HOME=$CODEX_HOME" >> "$GITHUB_ENV"
+          if [ -z "${OPENAI_API_KEY:-}" ]; then
+            echo "::warning::OPENAI_API_KEY is unavailable; Codex eval cases cannot authenticate and will fail."
+            exit 0
+          fi
+          printenv OPENAI_API_KEY | "$codex" login --with-api-key
+          "$codex" login status >/dev/null 2>&1
+
       - name: Run gate census slice ${{ matrix.slice }}
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

.github/workflows/evals.yml

@@ -274,6 +274,30 @@ jobs:
           mkdir -p /tmp/paid-slice-results/receipts
           if [ -d /tmp/paid-plan/receipts ]; then cp -a /tmp/paid-plan/receipts/. /tmp/paid-slice-results/receipts/; fi
 
+      # The image ships the pinned Codex CLI off PATH and without a
+      # credential; codex does not read OPENAI_API_KEY from the environment.
+      # Log it in from the secret (same-repo runs only) under a non-default
+      # home. The shard runner hands that home and the CLI to the Codex files
+      # only (scripts/lib/paid-cases.ts scopeCodexAccess); every other paid case sees no
+      # Codex, as before. Without a key the Codex cases fail; they never pass.
+      - name: Authenticate the Codex CLI
+        shell: bash
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        run: |
+          set -euo pipefail
+          codex="${GSTACK_CI_CODEX_BIN_DIR:?}/codex"
+          export CODEX_HOME="$HOME/.gstack-ci-codex"
+          mkdir -p "$CODEX_HOME"
+          echo "GSTACK_CI_CODEX_HOME=$CODEX_HOME" >> "$GITHUB_ENV"
+          if [ -z "${OPENAI_API_KEY:-}" ]; then
+            echo "::warning::OPENAI_API_KEY is unavailable; Codex eval cases cannot authenticate and will fail."
+            exit 0
+          fi
+          printenv OPENAI_API_KEY | "$codex" login --with-api-key
+          "$codex" login status >/dev/null 2>&1
+
       - name: Run slice ${{ matrix.slice }}
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

.github/workflows/free-tests.yml

@@ -91,6 +91,43 @@ jobs:
           for file in "${files[@]}"; do test -f "$file"; done
           bun test "${files[@]}"
 
+  # Named regressions that only reproduce on macOS's default temp root:
+  # $TMPDIR sits under /var/folders and /var is a symlink to /private/var, so
+  # code that compares a realpath with an unresolved path passes on Linux's
+  # /tmp and fails here (#2982). TMPDIR is deliberately left at the runner's
+  # default, and the job fails if that layout is not symlinked.
+  macos-named-regressions:
+    runs-on: macos-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.4.0
+      - name: Install dependencies
+        run: bun install --frozen-lockfile --ignore-scripts
+      - name: Build browser prerequisites
+        run: |
+          bunx playwright install chromium
+          bun run build
+      - name: Configure git identity (tests init temp repos)
+        run: |
+          git config --global user.email "free-tests-ci@gstack.test"
+          git config --global user.name "Free Tests CI"
+          git config --global init.defaultBranch main
+      - name: Run the named macOS regressions on the default temp root
+        run: |
+          set -euo pipefail
+          tmp="${TMPDIR:-/tmp}"
+          resolved="$(realpath "$tmp")"
+          echo "temp root: $tmp -> $resolved"
+          test "$resolved" != "${tmp%/}"
+          files=(test/gstack-design-detect.test.ts browse/test/chromium-profile-isolation.test.ts test/cso-git-hardening.test.ts test/plan-count-file-permission.test.ts test/spec-quality-gate-secret-sink.test.ts test/gstack-memory-ingest.test.ts)
+          for file in "${files[@]}"; do test -f "$file"; done
+          bun test "${files[@]}"
+
   cso-windows-launcher:
     runs-on: windows-latest
     timeout-minutes: 15
@@ -110,6 +147,14 @@ jobs:
         run: bun run test:cso:windows
         env:
           GSTACK_CSO_WINDOWS_TESTS: "1"
+      - name: Upload #2894 lease diagnostics
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: cso-lease-diagnostics-a${{ github.run_attempt }}
+          path: ${{ runner.temp }}/cso-lease-diagnostics
+          if-no-files-found: ignore
+          retention-days: 14
 
   cso-docker-integration:
     runs-on: ubuntu-24.04
@@ -178,7 +223,7 @@ jobs:
           name: free-plan
           path: ${{ runner.temp }}
 
-      - uses: actions/cache@v6
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ~/.bun/install/cache
           key: linux-bun-${{ hashFiles('bun.lock') }}
@@ -189,7 +234,7 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
-      - uses: actions/cache@v6
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ~/.cache/ms-playwright
           key: linux-playwright-${{ hashFiles('bun.lock') }}
@@ -323,15 +368,16 @@ jobs:
   # gate is merge-blocking without a separate branch-protection migration.
   free-tests:
     if: always()
-    needs: [free-suite, typecheck, cso-macos-launcher, cso-windows-launcher, cso-docker-integration]
+    needs: [free-suite, typecheck, cso-macos-launcher, macos-named-regressions, cso-windows-launcher, cso-docker-integration]
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
-      - name: Require the free suite, typecheck, and every CSO platform gate
+      - name: Require the free suite, typecheck, macOS regressions, and every CSO platform gate
         env:
           FREE_SUITE_RESULT: ${{ needs.free-suite.result }}
           TYPECHECK_RESULT: ${{ needs.typecheck.result }}
           CSO_MACOS_RESULT: ${{ needs.cso-macos-launcher.result }}
+          MACOS_REGRESSIONS_RESULT: ${{ needs.macos-named-regressions.result }}
           CSO_WINDOWS_RESULT: ${{ needs.cso-windows-launcher.result }}
           CSO_DOCKER_RESULT: ${{ needs.cso-docker-integration.result }}
         run: |
@@ -339,6 +385,7 @@ jobs:
           test "$FREE_SUITE_RESULT" = success
           test "$TYPECHECK_RESULT" = success
           test "$CSO_MACOS_RESULT" = success
+          test "$MACOS_REGRESSIONS_RESULT" = success
           test "$CSO_WINDOWS_RESULT" = success
           test "$CSO_DOCKER_RESULT" = success
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

.github/workflows/make-pdf-gate.yml

@@ -49,9 +49,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.4.0
 

.github/workflows/quality-gate.yml

@@ -35,7 +35,7 @@ jobs:
       # take ~12s combined. The one history consumer (the added-lines diff)
       # fetches its exact base/head SHAs below — an exact-SHA fetch, not a
       # guessed depth, so long-lived branches and merge queues still resolve.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.4.0

.github/workflows/scorecard.yml

@@ -0,0 +1,52 @@
+name: OpenSSF Scorecard
+# Supply-chain posture report (#1997): pinned actions, token permissions,
+# branch protection, dangerous workflow patterns. Results land in the
+# Security tab as code-scanning alerts and are published to
+# api.scorecard.dev for the badge.
+#
+# Publishing imposes rules this file must keep: no workflow-level env,
+# defaults or write permissions; `id-token: write` only on the job that runs
+# ossf/scorecard-action; that job uses only approved actions on a GitHub
+# hosted Ubuntu runner, with no env, defaults, containers or `run:` steps.
+# Scorecard does not support forks, so the job runs only in this repository.
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '41 5 * * 2'
+  branch_protection_rule:
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analysis:
+    if: github.repository == 'garrytan/gstack'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: scorecard-sarif
+          path: results.sarif
+          retention-days: 5
+
+      - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        with:
+          sarif_file: results.sarif

.github/workflows/skill-docs.yml

@@ -25,8 +25,8 @@ jobs:
     runs-on: ubicloud-standard-2
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.4.0
       - run: bun install --frozen-lockfile

.github/workflows/version-gate.yml

@@ -21,13 +21,13 @@ jobs:
       pull-requests: read
     steps:
       - name: Checkout PR head
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.4.0
 

.github/workflows/windows-free-tests.yml

@@ -61,9 +61,9 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.4.0
 
@@ -74,7 +74,7 @@ jobs:
       # bun install was 35s of a 55s job, all network. Cache keyed on the
       # lockfile; bun's install cache lives under ~/.bun/install/cache on
       # every platform.
-      - uses: actions/cache@v6
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ~/.bun/install/cache
           key: windows-bun-${{ hashFiles('bun.lock') }}
@@ -175,7 +175,7 @@ jobs:
       # automatically, so no per-file entry is needed here.)
       - name: Upload full shard logs
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: windows-free-test-shard-logs
           path: |
@@ -186,7 +186,7 @@ jobs:
 
       - name: Upload flake ledger
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: flake-ledger-windows
           path: ${{ runner.temp }}/flake-ledger.jsonl

.github/workflows/windows-setup-e2e.yml

@@ -41,15 +41,15 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.4.0
 
       # Same lockfile-keyed install cache as windows-free-tests.yml (install
       # was 45s of a 64s job, all network).
-      - uses: actions/cache@v6
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ~/.bun/install/cache
           key: windows-bun-${{ hashFiles('bun.lock') }}