Security hardening: script injection and third-party actions

Against script injection, prefer a JavaScript action that receives the context value as an argument instead of an inline script; when an inline script must handle untrusted input, assign the expression to an intermediate environment variable — for example env: TITLE: ${{ github.event.pull_request.title }} — so the value never participates in script generation, and double-quote shell variables to avoid word splitting. Treat pull_request_target and workflow_run as privileged triggers that can carry repository write access and referenced secrets: avoid pull_request_target unless needed, prefer workflow_run for privilege separation, and never check out untrusted pull request code under these triggers. Audit and rotate registered secrets periodically, and gate environment secrets behind required reviewers. For third-party actions, pin to a full-length commit SHA — currently the only way to consume an action as an immutable release — verifying the SHA is from the action's repository, not a fork; use tags only for trusted creators, since tags can be moved or deleted. Audit the action's source code, restrict GITHUB_TOKEN permissions, add .github/workflows to CODEOWNERS so changes require designated review, and use OpenID Connect for short-lived cloud access tokens. Scope: GitHub Actions. Reviewed October 4, 2026.