The marketplace step installed @anthropic-ai/claude-code at whatever
latest resolved to, so the same commit could pass one day and fail
the next, and each run executed unreviewed new code on the runner.
The skills step already pinned 1.5.20; this makes the policy uniform.
Actions move from mutable tags to full commit SHAs per GitHub's
hardening guidance, with versions in trailing comments for bumps.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Scott Emberson