From 89beb3636af066c04f00bc5ceab2a33340730c95 Mon Sep 17 00:00:00 2001
From: Olize <53581423+Olize@users.noreply.github.com>
Date: Wed, 21 Oct 2026 17:34:31 +0200
Subject: [PATCH 1/2] ci: pin external Actions and limit token to read-only

---
 .github/workflows/ci.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b243b69..bcd5581 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,11 +1,16 @@
 name: CI
 
 on:
+  # Push checks on private main are used by the release gate.
+  # Feature branches are checked by pull_request to avoid duplicate runs.
   push:
     branches: [main]
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test and build
@@ -15,11 +20,11 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable branch (2026-10-21)
         with:
           components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
       - name: Formatting
         run: cargo fmt --check
       - name: Clippy

From d520ddc16e2b76cfd8d4b84c59e422c3c207e56a Mon Sep 17 00:00:00 2001
From: Olize <53581423+Olize@users.noreply.github.com>
Date: Wed, 21 Oct 2026 17:34:53 +0200
Subject: [PATCH 2/2] docs(ci): clarify public workflow triggers

---
 .github/workflows/ci.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bcd5581..ce79e69 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,8 +1,7 @@
 name: CI
 
 on:
-  # Push checks on private main are used by the release gate.
-  # Feature branches are checked by pull_request to avoid duplicate runs.
+  # Run on protected public main and on pull requests.
   push:
     branches: [main]
   pull_request: