.github/actions/setup-zig/action.yml:14 uses a mutable tag:
Every other third-party action in the workflows is SHA-pinned (e.g. actions/checkout@df4cb1c0... # v6, actions/setup-node@48b55a01... # v6.4.0), so this is the one remaining action a tag move or upstream compromise could swap out from under CI — and it's the one that installs the toolchain used to build release artifacts.
Suggested fix: pin to the current v2 commit SHA with a # v2 comment, matching the convention used everywhere else in this repo.
.github/actions/setup-zig/action.yml:14uses a mutable tag:Every other third-party action in the workflows is SHA-pinned (e.g.
actions/checkout@df4cb1c0... # v6,actions/setup-node@48b55a01... # v6.4.0), so this is the one remaining action a tag move or upstream compromise could swap out from under CI — and it's the one that installs the toolchain used to build release artifacts.Suggested fix: pin to the current v2 commit SHA with a
# v2comment, matching the convention used everywhere else in this repo.