Scott Emberson 325469aea8 Pin CI dependencies to exact versions and commit SHAs ...

The marketplace step installed @anthropic-ai/claude-code at whatever
latest resolved to, so the same commit could pass one day and fail
the next, and each run executed unreviewed new code on the runner.
The skills step already pinned 1.5.20; this makes the policy uniform.
Actions move from mutable tags to full commit SHAs per GitHub's
hardening guidance, with versions in trailing comments for bumps.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-20 20:23:06 +01:00

..

validate.yml

Pin CI dependencies to exact versions and commit SHAs

2026-08-20 20:23:06 +01:00