4 commits

Author	SHA1	Message	Date
Adam Moussa	02f11e6535	chore(ci): pin central workflow refs to v1.0.0 ... The four refs pointed at fd60e4c9 with a '# main' comment. That comment names a branch, so Dependabot rendered its bump PR titles as two full 40-character SHAs. Sea-Haven-Industries/.github now publishes tags. Repoints all four at 2fbfb2e (v1.0.0) and replaces the comment with the version. Deliberately v1.0.0 rather than the current v1.0.2, so a Dependabot run has a newer version to find.	2026-07-28 17:37:36 -04:00
Adam Moussa	849f33a0bc	chore: resolve open code-scanning alerts (workflow permissions + Gusto URL sanitization) (#81) ... * ci: add least-privilege permissions blocks to workflow callers Resolves code scanning alerts #4 and #5 (actions/missing-workflow-permissions). Both callable workflows only need contents: read; the dependency-review callable already declares it internally, this caps the caller token to match. * enhance(email): improve detection of allowed Gusto URLs in email classification Resolves code scanning alert #2	2026-07-23 20:38:07 +00:00
Adam Moussa	fc4b090bd5	chore(ci): SHA-pin org reusable-workflow caller refs (INFRA-50) (#58)	2026-07-06 18:27:02 -04:00
Adam Moussa	d813e76a78	Add CI workflow (#24)	2026-05-08 15:49:44 -04:00