Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/deploy-prod.yml:
- Around line 32-35: The actions/checkout@v4 action is persisting Git
credentials by default, which unnecessarily exposes the GITHUB_TOKEN. Add a new
line to the with section of the actions/checkout@v4 action to set
persist-credentials: false, ensuring that Git credentials are not persisted to
.git/config since the deployment step provides an explicit token and no
subsequent steps require persisted credentials.
- Line 32: The actions/checkout@v4 action is using a floating tag which poses a
security risk. Replace the floating tag `@v4` with the full commit SHA of that
release to pin the action to an immutable version. Visit the actions/checkout
repository releases page on GitHub, find the commit SHA associated with the v4
tag, and update the action reference from actions/checkout@v4 to
actions/checkout@<full-commit-sha> using the exact SHA provided by GitHub.

In @.github/workflows/deploy-staging.yml:
- Line 53: The commit_message field currently uses ${{ github.sha }} which may
not match the actual deployed commit when the workflow is manually triggered
with a custom ref parameter. Instead, capture the actual HEAD SHA of the
checked-out repository (typically available as an output from the checkout step
or by running a git command to get the current HEAD SHA) and replace the ${{
github.sha }} reference in the commit_message with this captured actual SHA
value to ensure the staging commit metadata reflects the true deployed commit.
- Line 31: The GitHub Actions in the workflow file are pinned to mutable version
tags (actions/checkout@v4) which creates a supply chain security risk. Replace
all instances of mutable version tag references (including actions/checkout@v4
at line 31 and the similar references at lines 35 and 47) with their full commit
SHA hashes to make the action references immutable. Determine the correct commit
SHA for each action version and update the uses directive accordingly to
eliminate the vulnerability.
- Around line 31-33: The actions/checkout@v4 step is persisting credentials by
default, which makes the GITHUB_TOKEN available to all subsequent workflow steps
unnecessarily. Add persist-credentials: false to the with section of the
actions/checkout@v4 step to disable credential persistence. This hardens the
workflow by ensuring that the GitHub token is only available where explicitly
needed, specifically in the publish step that receives github_token directly.

---

Nitpick comments:
In @.github/workflows/deploy-preview.yml:
- Line 25: The `actions/checkout@v4` action currently persists the GitHub token
in `.git/config` by default, creating a security risk if malicious code executes
in subsequent workflow steps. Add the `persist-credentials: false` parameter to
the checkout action configuration to disable this behavior. Since the
`peaceiris/actions-gh-pages` action on line 41 provides its own `github_token`
parameter, this change will harden security without affecting the workflow's
functionality.
- Around line 7-9: Remove the workflow-level permissions block from the top of
the workflow file and instead add job-specific permissions. For the deploy job,
add permissions with contents: write and pull-requests: write, and for the
cleanup job, add permissions with only contents: write. This follows the
principle of least privilege by ensuring each job only receives the permissions
it actually requires for its operations.