[codeforester]

Summary

• pin both PyPI/TestPyPI publisher steps to the reviewed v1.14.3 commit
• update the package workflow regression test to require the expected pin
• add a guard that rejects non-SHA action references in the release workflow

Security rationale

The release workflow is privileged and must not execute a mutable action tag. The v1.14.3 tag resolves to 7245906fb61fa33a13554f9d5fb856fe61758086; the version comment remains visible for Dependabot and maintainer updates.

Validation

• UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra dev pytest -q tests/test_package_workflow.py
• git diff --check

Relates to #485.

[codeforester]

Implemented the review follow-up in commit f317ad82.

• The regression test now scans every .github/workflows/*.yml file, not just package.yml, and fails if any third-party action is not pinned to a full 40-character commit SHA.