[xavi-999]

What & why

Hardens CI against the supply-chain vectors in Socket's Hardening GitHub Actions against outside threats. The workflows already avoided pull_request_target, workflow_run, expression injection, secrets, caches and self-hosted runners; this closes the remaining gaps:

• Every action pinned to a commit SHA (with version comment) instead of a mutable tag.
• GITHUB_TOKEN scoped explicitly: ci.yml is contents: read; pages.yml defaults to {}, with pages: write / id-token: write only on the deploy job, which runs no project code.
• actions/checkout with persist-credentials: false.
• npm ci --ignore-scripts (no locked dependency needs install scripts).

Checklist

• npm test passes (stats · playbook · doctor · trace · bundle · lcp-attribution self-tests)
• claude plugin validate . --strict passes (if manifests changed)
• CHANGELOG.md updated
• Versions harmonized across package.json / plugin.json / marketplace.json (release PRs only)
• Docs updated if behavior changed (README.md, .claude/CLAUDE.md, skills/browsergnome/references/)

Locally verified with npm ci --ignore-scripts, npm test and actionlint (clean). Manifests unchanged, CI-only change so no CHANGELOG entry.

[claude]

I reviewed this PR and didn't find any bugs. The change edits GITHUB_TOKEN permissions and pins third-party actions by SHA, so a human should still confirm the pins before merging.

What was reviewed:

• Permissions split in pages.yml: build gets only contents: read, deploy gets only pages/id-token: write. The deploy job runs only actions/deploy-pages, so the new comment is accurate.
• persist-credentials: false: no later step pushes or uses git auth. The excalidraw fetch is an anonymous public clone.
• npm ci --ignore-scripts: no package in package-lock.json has hasInstallScript, and the root package.json has no install or prepare hook.
• Not done: I couldn't check that the four pinned SHAs match their comments (checkout v7.0.1, setup-node v7.1.0, upload-pages-artifact v5.0.0, deploy-pages v5.0.1) or that upload v5 and deploy v5 work together, because this sandbox has no network access.

Extended reasoning...

The change touches only .github/workflows/ci.yml and .github/workflows/pages.yml. It scopes GITHUB_TOKEN permissions, pins four actions to commit SHAs with major version bumps, disables persisted checkout credentials and skips npm install scripts. Workflow token permissions and action pins are security-sensitive. A SHA that doesn't match its version comment would itself be a supply-chain risk, and that couldn't be checked offline. I deferred because the pins and the new major-version pairing need upstream confirmation, not because of any bug in the diff.