[codeforester]

Summary

• pin both PyPI/TestPyPI publisher steps to the reviewed v1.14.3 commit
• update the package workflow regression test to require the expected pin
• add a guard that rejects non-SHA action references in the release workflow

Security rationale

The release workflow is privileged and must not execute a mutable action tag. The v1.14.3 tag resolves to 7245906fb61fa33a13554f9d5fb856fe61758086; the version comment remains visible for Dependabot and maintainer updates.

Validation

• UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra dev pytest -q tests/test_package_workflow.py
• git diff --check

Relates to #485.

[codeforester]

Guard scope gap: test_package_workflow_pins_every_third_party_action_to_a_full_sha only scans .github/workflows/package.yml. Issue #485's acceptance criteria call for "CI fails when a new unpinned action reference is introduced" in privileged release workflows generally, but docs.yml and project-intake.yml also carry id-token: write/secrets.* access and have no equivalent regression test. A future PR could reintroduce a mutable tag (or add a new third-party action pinned by tag) in one of those files and nothing in the test suite would catch it. Consider parameterizing this test over all workflow files under .github/workflows/ (or at least all files with elevated permissions) rather than hardcoding package.yml.