[sds]

Summary

Every tempoxyz/gh-actions pin (24 references; previously 947d9a3c) moves to 35019557465e3c38ee3468be171771fd73577584, tag 2026-10-20T06-22-38Z-35019557, with the tag comments updated. No derived files needed regenerating, and nothing was deliberately left unchanged.

Files

• .github/actions/setup-pnpm/action.yml
• .github/actions/setup-slack-config-token/action.yml
• .github/workflows/check.yml
• .github/workflows/dependency-scan.yml
• .github/workflows/preview.yml
• .github/workflows/preview_deploy.yml
• .github/workflows/preview_destroy.yml
• .github/workflows/preview_sweep.yml
• .github/workflows/production.yml
• .github/workflows/scan-github-actions.yml

[claude]

LGTM. This is a mechanical pin bump for tempoxyz/gh-actions.

What was reviewed:

• All 24 tempoxyz/gh-actions references across the 2 composite actions and 8 workflows now point to the same full 40-hex SHA 35019557465e3c38ee3468be171771fd73577584. Each one's tag comment matches it (2026-10-20T06-22-38Z-35019557).
• No reference to the old 947d9a3c pin is left anywhere in the repo.
• The diff stat is 24 lines added and 24 removed, one per reference. No inputs, permissions or other action pins change.

Extended reasoning...

The change only touches CI. It moves every tempoxyz/gh-actions pin (secure-runner, github-sts, the vendored pnpm and wrangler actions, and the reusable scan workflows) from one commit SHA to another in 10 files under .github. The only sensitive surface is the CI supply chain: these actions run on the runners and mint tokens, and this review cannot inspect what the upstream commit contains. The bump is uniform and complete, keeps SHA pinning, and follows the repo's existing convention of one shared SHA for all gh-actions references. No CODEOWNERS file covers these paths, and the PR has no outstanding reviewer objections.