mirror of
https://github.com/storytold/figcraft.git
synced 2026-10-24 12:18:36 +00:00
Pin third-party actions to full-length commit SHAs (with version comments) instead of mutable tags/branches to prevent supply-chain tampering via retagged releases. Resolves SonarCloud rule githubactions:S7637.