bherbruck bca8e81f1b Harden release and progress workflows ...

release.yml holds CARGO_REGISTRY_TOKEN: drop Swatinem/rust-cache (a
compromised tag or poisoned cache could tamper with the build before
publish), pin actions/checkout to the v4.2.2 commit SHA, and do not
persist git credentials. progress.yml (contents: write) also pins
checkout. Flagged by an automated security review.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-13 07:41:07 -04:00

..

workflows

Harden release and progress workflows

2026-10-13 07:41:07 -04:00