Actions policy: switch the org from "allow all" to an allowlist #14

What remains. The org setting is currently allowed_actions: all with sha_pinning_required: false. Any workflow in any Ownima repository can pull in any third-party action, including on the self-hosted ci-ownima*, worker-ownima and infra-new-ownima runners, which sit next to secrets. Switching to "Allow select actions and reusable workflows" limits that to a reviewed list.

Why not done now. An allowlist that misses an action breaks that repository's CI. The list must come from what the repositories actually use, checked before the switch.

Third-party actions used across the Ownima checkouts on 2026-10-22. Both GitHub-owned and verified creators can also be allowed as classes.

• GitHub-owned actions/*: checkout, upload-artifact, download-artifact, cache, setup-node, setup-java, github-script, labeler, create-github-app-token.
• astral-sh/setup-uv, oven-sh/setup-bun
• softprops/action-gh-release, googleapis/release-please-action, dependabot/fetch-metadata
• docker/login-action, docker/build-push-action, docker://rhysd/actionlint
• SonarSource/sonarqube-scan-action, dorny/paths-filter, robinraju/release-downloader
• peter-evans/create-pull-request, peter-evans/create-or-update-comment, appleboy/telegram-action, schneegans/dynamic-badges-action
• The reusable workflow zaebee/codegraph-brain/.github/workflows/guardian-reusable.yml@* (guardian, from ci(guardian): a reusable review workflow other repositories call zaebee/codegraph-brain#740).

Done when:

1. The list is re-collected from every Ownima repository's main, so a checkout that is not on the workstation is not missed.
2. The org is switched to the allowlist. Consider sha_pinning_required: true too, since most workflows already pin by SHA.
3. One CI run per repository is green afterwards.

🤖 Generated with Claude Code