chore(agents-md): require SHA-pin for third-party GitHub Actions

[LiukScot]

Summary

• Updates AGENTS.md §14: third-party GitHub Actions must be pinned to a full commit SHA with # vX.Y.Z comment (Dependabot still bumps SHA+comment together).
• GitHub-owned actions (`actions/`, `github/`) may keep tags; SHA preferred for defense-in-depth.

Why

Tag references can be silently rewritten by a compromised maintainer account. SHA pins are immutable. Dependabot supports SHA bumps when a `# vX.Y.Z` comment is present, so maintenance cost stays low.

This change also corrects a self-inflicted bug surfaced in #59: I'd interpreted §14 as forbidding SHA pins on github-owned actions, which led to a tag-revert commit. The new wording removes that ambiguity.

Follow-up (not in this PR)

• Audit existing workflows and convert third-party tags to SHA pins.
• Verify `.github/dependabot.yml` includes the `github-actions` ecosystem.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0ba6bad1-cd08-4b9c-972f-cbc462ca77ec

📥 Commits

Reviewing files that changed from the base of the PR and between a7156be and 0b7b46c.

📒 Files selected for processing (1)

• AGENTS.md

---

📝 Walkthrough

Walkthrough

Updated AGENTS.md to require pinning third-party GitHub Actions to full commit SHAs with Dependabot version comments. GitHub-owned actions may use version tags with SHA pinning preferred. Replaced prior guidance about tracking actions by latest stable tag.

Changes

GitHub Actions Pinning Policy

Layer / File(s)	Summary
GitHub Actions pinning policy update AGENTS.md	Updated CI workflow guidance to require third-party GitHub Actions (non-actions/* and non-github/*) be pinned to full commit SHAs with # vX.Y.Z comments for Dependabot. GitHub-owned actions may remain on version tags, though SHA pinning is preferred for defense-in-depth. Replaced prior policy to track third-party actions by latest stable tag with changelog reviews on major bumps.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly describes the main change: requiring SHA pinning for third-party GitHub Actions, which aligns perfectly with the PR's core objective and the AGENTS.md modifications.
Description check	✅ Passed	The description comprehensively explains the changes to AGENTS.md §14, the security rationale for SHA pinning, Dependabot support, and correction of a prior misinterpretation, all directly related to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}