Security context

Highlights

Supply Chain Security: 3 prior fixes. Scrutinize any change in this area.

.github/workflows/check.yaml: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Supply Chain Security: Cache poisoning in GitHub Actions can inject malicious dependencies or build artifacts into sensitive workflows, leading to code execution or credential theft. The fix disabled automatic caching for sensitive events, but caching on non-sensitive events or manual cache usage remains a potential vector.

Supply Chain Security: Checking out fork PRs in pull_request_target or workflow_run events allows untrusted code to execute in a privileged context, potentially exfiltrating secrets or modifying release artifacts. The fix blocks this, but any new workflow that checks out PRs without this guard is vulnerable.

Supply Chain Security: Unverified third-party actions can be compromised or replaced, leading to arbitrary code execution and credential exposure. The fix pins actions to commit hashes and disables credential persistence, but any future action added without these protections reintroduces the risk.