ci(workflows): SHA-pin every action + scope token permissions to jobs

Closes 71 of the 75 open Code Scanning alerts (68 Pinned-Dependencies
+ 3 Token-Permissions). All findings are Scorecard checks on workflow
security posture, not exploitable code defects — but the public-repo
flip exposes them to anyone browsing the Security tab, so closing
them improves the project's posture signal before Phase 3.8 GA.

PIN: every `uses: <action>@<tag>` reference in
.github/workflows/*.yml is now pinned to its full commit SHA with
the original tag preserved as a trailing comment:

    uses: actions/checkout@de0fac2 # v6

This is the Scorecard- and Dependabot-recognized format. SHAs were
resolved on 2026-05-22 via `gh api repos/<action>/commits/<tag>`.
Dependabot will continue to bump them on its own schedule — it
recognizes the trailing tag comment and updates both the SHA and
the comment atomically.

13 actions across 16 workflow files, 57 references pinned total
(some workflows reference the same action multiple times):

  actions/checkout              @v6      -> de0fac2...
  actions/configure-pages       @v6      -> 45bfe01...
  actions/deploy-pages          @v5      -> cd2ce8f...
  actions/setup-node            @v6      -> 48b55a0...
  actions/setup-python          @v6      -> a309ff8...
  actions/upload-artifact       @v7      -> 043fb46...
  actions/upload-pages-artifact @v5      -> fc324d3...
  github/codeql-action/{init,analyze,autobuild,upload-sarif} @V3 -> 03e4368...
  gitleaks/gitleaks-action      @v2      -> ff98106...
  ossf/scorecard-action         @v2.4.0  -> 62b2cac...
  sigstore/cosign-installer     @V3      -> 398d4b0...
  splunk/appinspect-api-action  @v3.0.5  -> 86013a6...
  zaproxy/action-baseline       @v0.14.0 -> 7c4deb1...

TOKEN PERMISSIONS: release.yml and codeql.yml had workflow-scope
`contents: write` / `security-events: write` permissions. Scorecard
flags workflow-scope writes that could be limited to a specific job.
Both workflows now declare `contents: read` at workflow scope and
elevate per-job where actually needed:

- release.yml: `release` job keeps `contents: write` + `id-token:
  write` (Sigstore OIDC + asset upload).
- codeql.yml:  `analyze` job keeps `security-events: write` (SARIF
  upload to Code Scanning UI).

Rationale comments added inline so future contributors understand
why the split exists and don't collapse the scopes back to workflow-
level on the next maintenance pass.

Remaining 4 alerts to be addressed separately:
- 1 Branch-Protection (repo Settings → Branches)
- 1 Code-Review (resolves with Branch-Protection)
- 1 Fuzzing (dismiss-with-rationale)
- 1 CIIBestPractices (dismiss-with-rationale)

No behaviour change to any workflow. Identical OIDC flow, identical
cosign behavior, identical SARIF upload behavior — SHA pinning is a
no-op until an attacker compromises an action repo (the threat model
this closes).

Author: RelativisticJet

.github/workflows/a11y-audit.yml

@@ -40,10 +40,10 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "20"
           cache: "npm"
@@ -87,7 +87,7 @@ jobs:
         # forms a longitudinal record. Reviewing the trend across
         # runs is more useful than just the latest run.
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: a11y-reports-${{ github.run_id }}
           path: tests/a11y/reports/
@@ -104,7 +104,7 @@ jobs:
 
       - name: Upload Splunk logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: a11y-splunk-logs-${{ github.run_id }}
           path: ci-logs/

.github/workflows/appinspect-api.yml

@@ -67,7 +67,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Build .spl
         run: bash scripts/package.sh
@@ -105,7 +105,7 @@ jobs:
           echo "Staged for AppInspect: $APPINSPECT_DIR/$(basename "$SPL_FILE")"
 
       - name: AppInspect API — Cloud Vetting profile (cloud tag)
-        uses: splunk/appinspect-api-action@v3.0.5
+        uses: splunk/appinspect-api-action@86013a62b0c773d1e9cd4623080b4495973936c3 # v3.0.5
         with:
           username: ${{ secrets.SPLUNK_DEV_USERNAME }}
           password: ${{ secrets.SPLUNK_DEV_PASSWORD }}
@@ -115,7 +115,7 @@ jobs:
 
       - name: AppInspect API — Self-Service Cloud profile (private_app tag)
         if: always()
-        uses: splunk/appinspect-api-action@v3.0.5
+        uses: splunk/appinspect-api-action@86013a62b0c773d1e9cd4623080b4495973936c3 # v3.0.5
         with:
           username: ${{ secrets.SPLUNK_DEV_USERNAME }}
           password: ${{ secrets.SPLUNK_DEV_PASSWORD }}

.github/workflows/appinspect.yml

@@ -50,7 +50,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       # `cache: pip` was removed 2026-05-18 — actions/setup-python@v5
       # requires `requirements.txt` or `pyproject.toml` to compute the
@@ -61,7 +61,7 @@ jobs:
       # restore the cache, but with a single one-line install of a pinned
       # package the cache hit is worthless. Keep simple.
       - name: Set up Python 3.11
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: '3.11'
 
@@ -159,7 +159,7 @@ jobs:
 
       - name: Upload AppInspect JSON reports
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: appinspect-reports
           path: .planning/appinspect/appinspect-*-ci.json

.github/workflows/ci.yml

@@ -53,10 +53,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.11"
 
@@ -67,7 +67,7 @@ jobs:
         run: bash scripts/package.sh
 
       - name: Upload .spl artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: wl_manager-spl
           path: dist/*.spl
@@ -79,7 +79,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Run doc-drift guard
         # Same script the pre-commit hook runs locally. Verifies
@@ -95,10 +95,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.11"
 
@@ -152,13 +152,13 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Node.js
         # Node 20 LTS. Vitest 3.x requires Node ≥18; we
         # pin to the latest LTS so the toolchain matches
         # what most contributors run locally.
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "20"
           # Cache npm dependencies keyed on package-lock.json

.github/workflows/codeql.yml

@@ -32,10 +32,13 @@ on:
     # synchronized load with other GitHub-hosted workflows.
     - cron: '17 6 * * 1'
 
+# Workflow-scope = least privilege (read-only). The `analyze` job
+# below elevates to `security-events: write` for uploading CodeQL
+# results to the Code Scanning UI. This pattern silences Scorecard's
+# TokenPermissions warning by scoping the write to the specific job
+# that needs it.
 permissions:
-  actions: read
   contents: read
-  security-events: write
 
 # Cancel in-flight CodeQL runs on the same ref (PR pushes can stack).
 concurrency:
@@ -55,6 +58,10 @@ jobs:
     if: github.event.repository.private == false
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
 
     strategy:
       fail-fast: false
@@ -63,10 +70,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3
         with:
           languages: ${{ matrix.language }}
           # Default query pack: security-and-quality.
@@ -78,9 +85,9 @@ jobs:
       # autobuild is a no-op for both but harmless to leave in — it's
       # the documented step for compiled-language matrices.
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/docs.yml

@@ -52,14 +52,14 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           # Fetch full history so future `git-revision-date-localized`
           # plugin support (if we add it) can read commit dates.
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: '3.11'
 
@@ -88,7 +88,7 @@ jobs:
         # Always upload — even on build failure we want the partial
         # site for debugging (mkdocs writes what it has).
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: site-${{ github.sha }}
           path: site/
@@ -120,12 +120,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: '3.11'
 
@@ -143,10 +143,10 @@ jobs:
         run: mkdocs build --verbose
 
       - name: Configure Pages
-        uses: actions/configure-pages@v6
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: site/
           # upload-pages-artifact v4.0.0 introduced a "hidden files are
@@ -161,4 +161,4 @@ jobs:
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

.github/workflows/e2e-full.yml

@@ -50,10 +50,10 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "20"
           cache: "npm"
@@ -171,7 +171,7 @@ jobs:
 
       - name: Upload logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: e2e-full-logs-${{ github.run_id }}
           path: ci-logs/
@@ -182,7 +182,7 @@ jobs:
         # when a comparison fails. Uploading them lets the next morning's
         # triage check the actual visual divergence.
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: visual-diffs-${{ github.run_id }}
           path: tests/e2e/visual_diff/

.github/workflows/e2e-smoke.yml

@@ -45,10 +45,10 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "20"
           cache: "npm"
@@ -121,7 +121,7 @@ jobs:
 
       - name: Upload logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: e2e-smoke-logs-${{ github.run_id }}
           path: ci-logs/

.github/workflows/integration-tests.yml

@@ -44,10 +44,10 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.11"
 
@@ -163,7 +163,7 @@ jobs:
 
       - name: Upload logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: splunk-logs-${{ github.run_id }}
           path: ci-logs/

.github/workflows/pip-audit.yml

@@ -34,10 +34,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.11"