fix: harden GitHub Actions workflows

.github/dependabot.yml

@@ -8,3 +8,5 @@ updates:
     schedule:
       interval: yearly
     open-pull-requests-limit: 0
+    cooldown:
+      default-days: 7

.github/workflows/binsuite.yml

@@ -129,7 +129,7 @@ jobs:
           node-version-file: .node-version
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -595,7 +595,7 @@ jobs:
           node-version-file: .node-version
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -1026,7 +1026,7 @@ jobs:
           node-version-file: .node-version
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

.github/workflows/ci.yml

@@ -51,7 +51,7 @@ jobs:
           cache: ''
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -117,7 +117,7 @@ jobs:
           cache: ''
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

.github/workflows/curl.yml

@@ -130,7 +130,7 @@ jobs:
           fi
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
 
       - name: Setup Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0

.github/workflows/ink.yml

@@ -86,7 +86,7 @@ jobs:
           node-version: ${{ steps.tool-versions.outputs.node-version }}
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
         # Note: version is specified in package.json packageManager field, not here
 
       - name: Install dependencies

.github/workflows/iocraft.yml

@@ -144,7 +144,7 @@ jobs:
           node-version: ${{ steps.tool-versions.outputs.node-version }}
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
         # Note: version is specified in package.json packageManager field, not here
 
       - name: Install dependencies

.github/workflows/lief.yml

@@ -128,7 +128,7 @@ jobs:
           fi
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
 
       - name: Setup Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0

.github/workflows/models.yml

@@ -67,7 +67,7 @@ jobs:
           node-version: ${{ steps.tool-versions.outputs.node-version }}
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
         # Note: version is specified in package.json packageManager field, not here
 
       - name: Install dependencies

.github/workflows/node-smol.yml

@@ -201,7 +201,7 @@ jobs:
           echo "Loaded Node.js build version: $NODE_BUILD_VERSION"
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

.github/workflows/onnxruntime.yml

@@ -99,7 +99,7 @@ jobs:
           node-version: ${{ steps.tool-versions.outputs.node-version }}
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
         # Note: version is specified in package.json packageManager field, not here
 
       - name: Install dependencies

.github/workflows/stubs.yml

@@ -208,7 +208,7 @@ jobs:
 
       - name: Setup pnpm
         if: matrix.os != 'linux'
-        uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
 
       - name: Setup Node.js
         if: matrix.os != 'linux'

.github/workflows/weekly-update.yml

@@ -39,7 +39,7 @@ jobs:
           cache: ''
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -182,7 +182,7 @@ jobs:
           cache: ''
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

.github/workflows/yoga-layout.yml

@@ -99,7 +99,7 @@ jobs:
           node-version: ${{ steps.tool-versions.outputs.node-version }}
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@58e6119fe4f3092a76a7771efb55e04d25b6b26f # v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
         # Note: version is specified in package.json packageManager field, not here
 
       - name: Install dependencies

.github/zizmor.yml

@@ -5,14 +5,17 @@ rules:
   cache-poisoning:
     ignore:
       # False positive: We explicitly disabled caching with cache: ''
-      # Line 43: checks job - Setup Node.js step
-      - ci.yml:43
+      # Line 48: checks job - Setup Node.js step
+      - ci.yml:48
       # False positive: We explicitly disabled caching with cache: ''
-      # Line 97: test job - Setup Node.js step
-      - ci.yml:97
+      # Line 114: test job - Setup Node.js step
+      - ci.yml:114
       # False positive: We explicitly disabled caching with cache: ''
-      # Line 180: stubs workflow - Setup Node.js step
-      - stubs.yml:180
+      # Line 215: stubs workflow - Setup Node.js step
+      - stubs.yml:215
+
+  secrets-outside-env:
+    disable: true
 
   template-injection:
     ignore: