a3613035f3
### Motivation - Pinning the action to an immutable commit SHA reduces the risk of arbitrary code execution in runners with repository access and secrets. ### Description - Replaced `uses: mlugg/setup-zig@v2` with `uses: mlugg/setup-zig@d1434d0886 # v2` in three workflow files. - Updated the following files: ` .github/workflows/rust-ci.yml`, ` .github/workflows/rust-release.yml`, and ` .github/workflows/shell-tool-mcp.yml` to reference the immutable SHA while preserving the original `v2` intent in a trailing comment. ### Testing - No automated tests were run because this is a workflow-only change and does not affect repository source code, so CI validation will occur on the next workflow execution. ------ [Codex Task](https://chatgpt.com/codex/tasks/task_i_69763f570234832d9c67b1b66a27c78d) |
||
|---|---|---|
| .. | ||
| actions | ||
| codex | ||
| ISSUE_TEMPLATE | ||
| scripts | ||
| workflows | ||
| blob-size-allowlist.txt | ||
| codex-cli-splash.png | ||
| dependabot.yaml | ||
| dotslash-config.json | ||
| pull_request_template.md | ||
