security: harden CI against supply-chain attacks (#20476)

- Pin all third-party actions to SHA - Gate claude.yml triggers to internal authors with Harden-Runner egress audit - Ignore fork-PR lifecycle scripts - Narrow cross-repo dispatch payloads - Add 7d npm release-age gate - Add CODEOWNERS on .github/** and .yarnrc.yml --------- Co-authored-by: prastoin <paul@twenty.com>
2026-05-12 17:50:29 +05:30
parent 79b612ee12
commit 565995e715
47 changed files with 311 additions and 237 deletions
@@ -48,7 +48,7 @@ runs:
        fi

    - name: Checkout docker compose files
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      with:
        repository: ${{ inputs.twenty-repository }}
        ref: ${{ steps.resolve.outputs.git-ref }}