SHA-pin the 4 publish-path third-party actions (release / crates.io-OIDC / codecov token surface)

[IvanWng97]

Deferred from PR #408's local two-lens review (the design/blast-radius lens). #408's body originally justified skipping SHA-pin as "actions are first-party (GitHub + Anthropic)" — that was wrong; verified live there are ~11 third-party actions, four of them on the credentialed publish path.

Problem

Floating action tags are mutable. Dependabot bumps the tag but does not protect against a malicious tag-move on a compromised upstream (cf. the tj-actions/changed-files Mar-2025 compromise). Most of pixtuoid's third-party actions run read-only in CI, but four run in the release/publish path with credentials, where a moved tag = token / supply-chain theft.

Pin these four (publish / credentialed path)

Action	Why it matters
rust-lang/crates-io-auth-action@v1	mints the crates.io OIDC token
softprops/action-gh-release@v3	creates the GH release (has a token)
orhun/git-cliff-action@v4	runs in the release-notes/publish job
codecov/codecov-action@v7	upload token; prior supply-chain history

OIDC trusted publishing (#216 / #383) makes the crates.io/npm token short-lived, which reduces but does not eliminate the exposure — a compromised action in the publish job can still exfiltrate the token during its validity window or publish a malicious artifact.

Leave floating (read-only CI — acceptable with Dependabot)

dtolnay/rust-toolchain, Swatinem/rust-cache, taiki-e/install-action, extractions/setup-just, EmbarkStudios/cargo-deny-action, withastro/action. A moved tag could poison a CI run, but these jobs hold no publish secrets; floating + Dependabot is an accepted posture.

Fix

• Pin each of the four to a full-length commit SHA with a trailing # vX.Y.Z comment (Dependabot updates pinned SHAs too, preserving the auto-bump).
• Scope to the workflow(s) that actually run these (release / publish / coverage), not a blanket repo-wide sweep.

Acceptance

The four publish-path actions reference a 40-hex commit SHA; Dependabot still tracks and bumps them; CI/release stays green.

[IvanWng97]

Decision (2026-07-02, whole-codebase cleanup): won't pin — closing.

Adjudicated with the maintainer during the 2026-07 cleanup round. The issue's threat model (tag-move on a compromised upstream) is real in general, but this repo's exposure profile doesn't justify the readability cost:

• The release/publish path is human-gated. The tag push is a deliberate manual step (workspace CLAUDE.md release protocol), so git-cliff-action / action-gh-release / crates-io-auth-action only ever execute during an attended release — not on an unattended high-frequency path where tag-move attacks thrive.
• OIDC trusted publishing (release.yml: OIDC trusted publishing for npm + crates.io (drop standing tokens) #216/v0.11.1: OIDC trusted publishing for crates.io + npm (#216) #383) keeps the crates.io token short-lived — the exfiltration window is minutes, during a human-attended run.
• codecov-action is the only unattended+token surface (every PR, prior 2021 uploader compromise) and was weighed separately; accepted as floating+Dependabot, consistent with the read-only-CI posture this issue itself grants.
• crates-io-auth-action@v1 is a branch ref, not a tag — pinning it would also change Dependabot's follow semantics.

Compensating controls on record: human-gated releases, OIDC short-lived tokens, weekly Dependabot on the actions ecosystem, and the daily security audit cron (revived in the same cleanup).

Explicit note for future review rounds: this is a deliberate maintainer override of the usual future-proof-by-default posture — don't re-file without a changed premise (e.g. releases becoming automated/unattended, or a new credentialed action on the PR path).