security: harden CI against supply-chain attacks (#20476)

- Pin all third-party actions to SHA - Gate claude.yml triggers to internal authors with Harden-Runner egress audit - Ignore fork-PR lifecycle scripts - Narrow cross-repo dispatch payloads - Add 7d npm release-age gate - Add CODEOWNERS on .github/** and .yarnrc.yml --------- Co-authored-by: prastoin <paul@twenty.com>
2026-05-12 17:50:29 +05:30
parent 79b612ee12
commit 565995e715
47 changed files with 311 additions and 237 deletions
@@ -29,12 +29,8 @@ jobs:
      matrix:
        task: [lint, typecheck, test]
    steps:
-      - name: Cancel Previous Runs
-        uses: styfle/cancel-workflow-action@0.11.0
-        with:
-          access_token: ${{ github.token }}
      - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 10
      - name: Install dependencies