{"agent":"claude","input":"Pin every third-party action in .github/workflows to the full commit SHA of its latest release, written as owner/repo@<sha> # vX.Y.Z. Leave local uses: ./ workflows alone. For dtolnay/rust-toolchain, pin the commit and move the toolchain from the ref into a toolchain: input. Move actions/upload-artifact and actions/download-artifact together. Read the release notes of every action that crosses a major version and fix any removed or renamed input. Run actionlint on every changed file. Open a pull request against dev with a table of each action, its old ref, new version and SHA, and make sure its checks pass.","resources":[{"url":"https://github.com/your-org/your-app"}]}