[dbachko]

GitHub Actions in the CLI validation and release workflows are referenced by mutable tags. Pin all 12 references to the verified full commit SHAs behind their existing exact versions, retaining each tag in a comment. Action versions, permissions, commands, triggers, and release behavior remain the same.

Only .github/workflows/ci.yml and .github/workflows/release.yml change. No application code, tests, credentials, scanner configuration, authentication documentation, or security-policy commitments change.

Validation:

• Verified each tag-to-commit mapping through the official GitHub Action repositories, including dereferencing annotated tags.
• Parsed both workflow files and confirmed they are structurally identical to the base after restoring only the uses references.
• git diff --check and npm run check passed: typecheck and 196 tests, with 5 platform-specific skips (local Node 26.10.0; CI retains Node 24.20.0).
• Reproduced the catalog scanner locally using its pinned plugin-scanner 3.57.0 wheel and hash-locked runtime dependencies with Python 3.12.10. Verified the wheel against the SHA-256 recorded in catalog Action c96833de5070fab4e564010b5ab6e3c3d7e07a3e.
• Used the Action's actual scan entry point against clean tracked-file snapshots: unchanged source e09ae112c45b29a084239634cdfe169437a3f367 measured 65/100 (34/52 points); this candidate measured 75/100 (39/52 points) and passed MIN_SCORE=75, FAIL_ON=none. Network probing, publishing, comments, repository policies, and baseline suppressions were disabled. All 12 unpinned-Action findings disappear.

The synthetic test-token match, missing SECURITY.md, and missing Dependabot findings remain. None is suppressed. This is the smallest workflow-only fix reaching the catalog's current threshold; it does not claim to resolve every scan finding.

Related listing: hashgraph-online/awesome-ai-plugins#1083 . The 75 result is local, not a catalog-owned passing scan. The catalog currently retains its measured 65 on the default-branch source; once this source fix is merged by a maintainer, the catalog must rerun its own required scan. This draft PR does not merge or release anything.