security: harden CI against supply-chain attacks (#20476)

- Pin all third-party actions to SHA - Gate claude.yml triggers to internal authors with Harden-Runner egress audit - Ignore fork-PR lifecycle scripts - Narrow cross-repo dispatch payloads - Add 7d npm release-age gate - Add CODEOWNERS on .github/** and .yarnrc.yml --------- Co-authored-by: prastoin <paul@twenty.com>
2026-05-12 17:50:29 +05:30
parent 79b612ee12
commit 565995e715
47 changed files with 311 additions and 237 deletions
@@ -21,11 +21,11 @@ jobs:
      any_changed: ${{ steps.changed-files.outputs.any_changed }}
    steps:
      - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 10
      - name: Check for changed files
        id: changed-files
-        uses: tj-actions/changed-files@v45
+        uses: tj-actions/changed-files@48d8f15b2aaa3d255ca5af3eba4870f807ce6b3c # v45.0.9
        with:
          files: ${{ inputs.files }}