Problem:
Our CI workflows trust more than they should actions/checkout and actions/setup-node are pinned to mutable v4 tags rather than fixed commits, the lychee binary is downloaded and executed with no checksum verification, neither workflow declares permissions so jobs inherit a potentially write-capable GITHUB_TOKEN, and check-format.yml never runs npm install, causing Prettier to silently fetch latest instead of the pinned version.
Proposed solution:
Pin both actions to commit SHAs, add a checksum check on the lychee download , scope both workflows to permissions: contents: read, and add the missing npm install --omit=optional step.
Problem:
Our CI workflows trust more than they should actions/checkout and actions/setup-node are pinned to mutable v4 tags rather than fixed commits, the lychee binary is downloaded and executed with no checksum verification, neither workflow declares permissions so jobs inherit a potentially write-capable GITHUB_TOKEN, and check-format.yml never runs npm install, causing Prettier to silently fetch latest instead of the pinned version.
Proposed solution:
Pin both actions to commit SHAs, add a checksum check on the lychee download , scope both workflows to permissions: contents: read, and add the missing npm install --omit=optional step.