feder-cr 62cdf626a0 ci: pin actions to SHA + single-source the playwright pin (audit B6/B4) ... B6: pin every third-party action in the build/publish path to an immutable commit SHA (a retagged actions/checkout or action-gh-release would otherwise inject code into the binary users download). The other workflows (tests, webrtc, launch-matrix) handle no secrets, so they're left on tags. B4: the playwright pin lived in two workflow files with no shared source. Move it to scripts/playwright_pin.txt that both read, so they can't drift. The drive gate already ENFORCES playwright<->juggler compatibility (an incompatible pin fails the launch/drive and nothing publishes); the file is the single bump point when the juggler is re-synced.		2026-06-09 15:59:18 +02:00
..
audit_cpt_realism.py	feat: initial public release	2026-05-12 22:32:58 -07:00
ci_drive_gate.py	ci: split drive gate — smoke on all 5 legs, full interaction on linux-x86_64	2026-06-09 15:01:21 +02:00
playwright_pin.txt	ci: pin actions to SHA + single-source the playwright pin (audit B6/B4)	2026-06-09 15:59:18 +02:00
run_e2e.py	test: activate the full e2e (browser-driving) suite + add fetch --force	2026-06-09 15:40:02 +02:00