v0.69.0 - GitHub Actions hardening audit

Highlights

• Added contextforge actions-audit to inspect .github/workflows/* for GitHub Actions hardening issues.
• Emits Markdown and SARIF so teams can attach release proof and upload findings to GitHub code scanning.
• Flags missing or broad permissions, mutable action refs, risky pull_request_target usage, pwn-request checkout patterns, and direct interpolation of untrusted GitHub contexts in shell scripts.
• Dogfooded the audit by pinning ContextForge workflows to full action SHAs and least-privilege permissions.

Validation

• PR #163 checks passed: CI and ContextForge Audit.
• Main checks passed after merge: CI and ContextForge Audit.
• Local validation: pnpm build, pnpm typecheck, pnpm test, security benchmark, workflow audit, actions audit, publish readiness, and npm pack dry-run.

Research anchors

• GitHub Actions script injection guidance: https://docs.github.com/en/actions/concepts/security/script-injections
• GitHub Security Lab untrusted input guidance: https://securitylab.github.com/resources/github-actions-untrusted-input/
• zizmor adjacent prior art: https://github.com/woodruffw/zizmor