Repository navigation
Validate GitHub Action repository identity while continuing to require full commit SHA pins. Reviewed action SHA updates can now be made in consumer workflows without changing duplicated hashes in the shared checker.
The consumer template now checks bufbuild/buf-action and reads exact Buf, Buffa, and cargo-fuzz versions from workflow environment values. Node jobs may use any explicit numeric Node version of at least 24. Existing explicit action and tool version policy options remain available when a fixed revision is required.
Update the documentation and regression coverage for these policies. The packaged runner retains its executable permission.