Repository workflow supply-chain hardening
- Pin every third-party Action in CI, Pages, and Star Watch to a full commit SHA.
- Add a repository-wide regression that rejects mutable third-party Action tags.
- Configure weekly Dependabot updates for GitHub Actions.
- Keep the same-repository
@v0references only as deliberate public compatibility probes. - Preserve v0.14 attestation-bound checkout/setup-node major versions; changing those identities requires a new producer/verifier evidence run rather than a dependency-only PR.
- Document the policy and exceptions in English and Simplified Chinese.
Verification
- 147 deterministic tests pass.
- CI: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31989908977
- Pages: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31989647549
- Star Watch with pinned checkout/setup/cache/upload Actions: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31989705701
- Dependabot policy evaluation completed without reopening the attestation-bound major upgrades: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31989911337
A full commit SHA identifies the Action code that ran; it does not prove that code is secure or semantically correct. Dependabot PRs still require review and CI.