CI and workflow security hardening (
1870b25)
This repo tightened GitHub Actions security across its workflows by pinning external actions to commit SHAs and setting repository-wide default token permissions to read-only. That reduces supply-chain risk and closes dozens of scorecard alerts without changing the actual action versions in use.
Other misc changes
- Workflow permissions and action pinning updates across CI and Algolia reindex jobs
- Dockerfile action/reference pinning cleanup
- Security alert remediation only; no product/runtime feature changes