ci: bound Context7 refresh transport

[kriptoburak]

Summary

• restrict the Context7 refresh request to HTTPS with TLS 1.2 or newer
• add a 10-second connection timeout and 30-second total timeout
• preserve the existing fixed runner and 5-minute job cap

Validation

• actionlint .github/workflows/context7-refresh.yml
• git diff --check
• verified the fixed runner, job timeout, and bounded curl controls
• simplify, maintainability, and security reviews completed with no findings

OpenSSF relevance

This bounds a secret-bearing external CI request and makes failure behavior deterministic.

Note

Enforce HTTPS, TLSv1.2, and timeouts on Context7 refresh CI request

Adds --connect-timeout 10, --max-time 30, --proto '=https', and --tlsv1.2 to the curl call in context7-refresh.yml. This prevents the refresh job from hanging indefinitely and restricts the request to secure transports only.

^{Macroscope summarized 446e5ce.}

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[furkanerday]

Reviewed the complete diff, PR description, all conversation and review history, unresolved threads, repository policies, relevant contracts and tests, required checks, and commit sign-offs at 446e5ce. All required checks pass, no actionable thread remains, and I found no blocking issue.