6f245639ca
The ruling from discussion #171 as ruled: canonical text in REVIEWER.md §What you review against item 2 (beside the verify-at-pin sub-bullet it is the sibling of), short form in BUILDER.md §Building pointing at it. CONTRIBUTING.md and docs/CONSUMERS.md checked for contradiction or duplication: none — their pin prose is the mirror/caller pinning rule — so both are deliberately untouched. Refs #216 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
7 lines
315 B
Markdown
7 lines
315 B
Markdown
### Changed
|
|
|
|
- Doctrine: third-party actions never hold a write-capable token by default —
|
|
repo-owned scripts in write-capable jobs, established publisher plus
|
|
full-SHA pin for the exception, SHA pins everywhere. Canonical in
|
|
REVIEWER.md, short form in BUILDER.md; consumers adopt at the pin bump
|
|
(#216).
|