Modernize

[apostasie]

No description provided.

[mendral-app]

Supply Chain Security Review

✅ Approve

Well-hardened CI setup: all GitHub Actions pinned by SHA (verified), restrictive permissions, credential hygiene (persist-credentials: false), shell-injection mitigations (branch name via env:), and aqua installer verified by SHA256. Renovate configured with 3-day release cooldown.

_{Tag @mendral-app with feedback or questions. View session}

[mendral-app]

Supply Chain Security Review

✅ Approve

No dependency changes detected by osv-scanner. Workflows use SHA-pinned actions (verified: actions/checkout v7.0.1, actions/create-github-app-token v3.2.0), minimal permissions: {} defaults with per-job scoping, and the custom setup-aqua action verifies the installer script via sha256 checksum. The update-aqua-checksum workflow's write access is appropriately constrained to Renovate branches only.

_{Tag @mendral-app with feedback or questions. View session}

[mendral-app]

Supply Chain Security Review

✅ Approve

Workflows use SHA-pinned actions (verified), minimal permissions, persist-credentials: false, and safe shell interpolation patterns. The update-aqua-checksum write workflow is well-scoped to Renovate branches with clear anti-recursion guards. No dependency changes detected by osv-scanner. Renovate config enforces a 3-day minimumReleaseAge cooldown.

_{Tag @mendral-app with feedback or questions. View session}