## Context OpenSSF Scorecard identified several follow-up opportunities while validating #1214. ## Follow-up work - [x] Pin all GitHub Actions to immutable full commit SHAs, retaining version comments for readability — #1216 - [x] Pin the commitlint packages installed dynamically in CI — #1217 - [x] Establish restrictive top-level `GITHUB_TOKEN` permission defaults — #1218 - [x] Remove unnecessary `contents: write` from the coverage job in `ci.yml` — #1219 - [x] Tighten `release-plz.yml` permissions by moving write grants to job scope — #1220 - [x] Pin the temporary release-plz fork to an immutable revision — #1221 - [ ] Add fuzzing coverage for protocol parsing/deserialization and consider continuous OSS-Fuzz integration. The linked PRs are intentionally focused so permission and dependency changes can be reviewed independently.
Context
OpenSSF Scorecard identified several follow-up opportunities while validating #1214.
Follow-up work
GITHUB_TOKENpermission defaults — ci: default workflow tokens to read-only contents #1218contents: writefrom the coverage job inci.yml— ci: remove coverage job write permission #1219release-plz.ymlpermissions by moving write grants to job scope — ci: scope release token permissions to jobs #1220The linked PRs are intentionally focused so permission and dependency changes can be reviewed independently.