feat(security): scan this module, and make its own pin check unfoolable

[rldyourmnd]

Two things, and the second was found only because of the first.

1. This repository has never been scanned

GET /code-scanning/analyses returns no analysis found; default setup is not-configured. Python is 75% of the tree and actions covers seven deployment workflows holding apply and rollback authority.

Four of the six public modules are in this state — github-device-sync (#25), github-actions (#138), cd-workflows (here) and agent-runtime (#4) — the entire Go control plane plus this one. Secret scanning and push protection were disabled on all six; both are free for public repositories and are now on.

2. This module's pin check accepted a catalog no YAML parser will load

Declaring the new caller in catalog/actions.yml put the entry in mis-indented by two spaces. yaml.safe_load refuses that file outright:

yaml.parser.ParserError: while parsing a block mapping
expected <block end>, but found '-'

scripts/validate_module.sh printed OK.

The parser it replaces stripped every line and looked for - name: anywhere, so indentation carried no meaning at all. A structurally broken catalog read "fine", and every pin comparison below ran against whatever that tolerant scan produced. The check could not distinguish a valid catalog from a corrupt one — which is the same trap as a duplicate YAML key that safe_load swallows while the real validator refuses it.

This is the check added to stop pin comments drifting, so it silently mis-reading its own registry is worth more than the cosmetic error that exposed it.

The module ships no dependencies and CI installs none, so the answer is not PyYAML. It now reads by column and refuses any other shape, with two invariants added: an empty registry fails rather than passing vacuously, and a SHA that is not 40 characters fails.

Each guard proved to refuse, not merely to pass

Injected	Result
the original mis-indented entry	catalog/actions.yml:23: catalog entries are exactly …
sha: "b50364e2a415"	records a 12-character SHA, expected 40
actions: with no entries	declares no actions; refusing to pass a check with nothing to check
the corrected catalog	OK

Verification

• scripts/validate_module.sh → 10 contract tests OK, pin check OK
• actionlint 1.7.12 → clean

Pinned to 0.1.4 at the commit that tag resolves to; see NDDev-OpenNetwork/ci-workflows#45 for why the estate's other pins cannot be copied. Left out of required_contexts until it has a green run on main.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.