chore: resolve the Scorecard alerts a repo change can fix

Every GitHub action is now pinned to a full commit SHA with its version
in a trailing comment, verified against each upstream repo's tags, so a
retagged release cannot swap code under CI. The publish workflow pins
npm to an exact version instead of @latest, the experiment Dockerfile
pins its base image by digest, and codeql.yml gets a top-level read-all
permissions block so the default token grants nothing the analyze job
does not ask for.

SECURITY.md points reports at GitHub private vulnerability reporting,
which is now enabled, and scopes out experiments/. Branch protection on
main now blocks force pushes and deletions.

.github/workflows/ci.yml

@@ -14,8 +14,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
       - run: npm ci

.github/workflows/codeql.yml

@@ -10,6 +10,9 @@ on:
   schedule:
     - cron: "17 3 * * 1"
 
+# The analyze job widens its own permissions; everything else gets none.
+permissions: read-all
+
 jobs:
   analyze:
     name: Analyze
@@ -20,12 +23,12 @@ jobs:
       security-events: write
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: github/codeql-action/init@v3
+      - uses: github/codeql-action/init@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8
         with:
           languages: javascript-typescript
 
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/analyze@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8
         with:
           category: "/language:javascript-typescript"

.github/workflows/dependency-review.yml

@@ -13,5 +13,5 @@ jobs:
   dependency-review:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/dependency-review-action@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0

.github/workflows/publish.yml

@@ -35,15 +35,16 @@ jobs:
     outputs:
       channel: ${{ steps.channel.outputs.channel }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # No registry-url here: it writes an .npmrc auth-token line with a
       # placeholder value, and npm then authenticates with that instead of
       # falling through to OIDC trusted publishing.
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
-      # Trusted publishing needs npm 11.5.1 or newer.
-      - run: npm install -g npm@latest
+      # Trusted publishing needs npm 11.5.1 or newer, pinned exactly so a
+      # release never runs an npm nobody reviewed.
+      - run: npm install -g npm@12.0.2
       - run: npm ci
       - run: npm test
       - name: pick channel and version
@@ -103,7 +104,7 @@ jobs:
     if: needs.publish.outputs.channel == 'latest'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
       # Same invocation the install-loop experiment proved out, telemetry left

.github/workflows/scorecard.yml

@@ -22,7 +22,7 @@ jobs:
       actions: read
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -32,12 +32,12 @@ jobs:
           results_format: sarif
           publish_results: true
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
-      - uses: github/codeql-action/upload-sarif@v3
+      - uses: github/codeql-action/upload-sarif@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8
         with:
           sarif_file: results.sarif

SECURITY.md

@@ -0,0 +1,24 @@
+# Security
+
+## Reporting a vulnerability
+
+Report vulnerabilities privately through GitHub: [Security > Report a
+vulnerability](https://github.com/only-cli/oc/security/advisories/new).
+Please do not open a public issue for anything exploitable.
+
+Expect an acknowledgement within a week. Fixes ship as a patch release,
+and the advisory is published once the fix is out.
+
+## Scope
+
+oc fetches untrusted web pages by design, so the interesting bugs are the
+ones where page content escapes its role as data: rendered text that can
+alter what an agent executes, URLs that reach private or internal hosts
+despite the SSRF guard, or a crafted page that breaks the distiller. Bugs
+in the experiments/ directory are out of scope; nothing there ships in
+the package.
+
+## Supported versions
+
+Only the latest release on npm is supported. There is no backporting; a
+security fix means a new release.

experiments/skills-install-remove-loop/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24-bookworm-slim
+FROM node:24-bookworm-slim@sha256:3638d9a6fe4030bd716be989438248074489337ba3275657f93595428be4fc03
 
 RUN apt-get update \
     && apt-get install --yes --no-install-recommends ca-certificates git \