Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/black.yaml:
- Line 14: The checkout step in the workflow should be hardened while keeping
the actions/checkout v7 upgrade. Update the `actions/checkout` reference in the
workflow to a pinned commit SHA for v7.0.0, and set `persist-credentials: false`
on that same checkout step so credentials are not left in the git config. Use
the existing checkout invocation as the anchor and adjust only this step.

In @.github/workflows/build_and_push_dev.yaml:
- Line 28: The checkout step is using a floating actions tag, which violates the
pinning policy. Update the uses reference in the workflow’s checkout step to a
specific commit SHA for actions/checkout v7 rather than the version tag, and
verify the SHA corresponds to v7.0.0 before changing it.

In @.github/workflows/build_pr.yaml:
- Line 26: The checkout step in the workflow is still using an unpinned action
reference, which violates the unpinned-uses policy. Update the
`actions/checkout` usage in this workflow to a pinned commit SHA, matching the
approach used or intended for the sibling workflow referenced by
`build_and_push_dev.yaml`, so the `checkout` step remains functionally the same
but is pinned for supply-chain safety.

In @.github/workflows/check_dependencies.yaml:
- Line 14: The checkout step in the workflow uses an unpinned action ref and
does not disable credential persistence, matching the same hardening gap as in
black.yaml. Update the `actions/checkout` usage in this workflow to a pinned
version/ref and set `persist-credentials` to false, following the same pattern
used for the hardened checkout configuration elsewhere.

In @.github/workflows/openapi_spectral.yaml:
- Line 18: The workflow step using actions/checkout is referencing a floating
tag instead of a fixed revision. Update the checkout step in the openapi
spectral workflow to pin actions/checkout to a specific commit SHA rather than
`@v7`, keeping the same step location and action usage but replacing the external
reference with an immutable digest.

In @.github/workflows/outdated_dependencies.yaml:
- Line 14: The workflow uses floating action references, so update the external
actions in this job to pinned commit SHAs instead of version tags. Replace the
`actions/checkout` and `astral-sh/setup-uv` references in the workflow with
their full SHA-pinned equivalents, and keep the existing step structure intact
so the pinned action versions remain easy to locate and maintain.

In @.github/workflows/pydocstyle.yaml:
- Line 14: The workflow uses a floating major tag for actions/checkout, so
update the checkout step in the pydocstyle workflow to reference the v7 commit
SHA instead of `@v7`. Locate the uses: actions/checkout entry and replace the tag
with the pinned SHA so the action version is fixed and reproducible.

In @.github/workflows/pylint.yaml:
- Line 15: The workflow step using actions/checkout is still referencing a
floating tag, so update that checkout usage to a specific commit SHA instead of
actions/checkout@v7. Keep the same workflow step in pylint.yaml and replace the
external action reference with a pinned SHA-based version so the pipeline uses
an immutable dependency.

In @.github/workflows/pyright.yaml:
- Line 15: The workflow step in pyright.yaml uses the mutable
actions/checkout@v7 tag; update the checkout action reference to a pinned commit
SHA instead of the version tag. Locate the step using actions/checkout and
replace the tag with the corresponding full commit hash to keep the action
immutable.

In @.github/workflows/ruff.yaml:
- Line 14: The checkout step in the ruff workflow should use a pinned action
reference and disable credential persistence, matching the same fix needed in
black.yaml. Update the actions/checkout usage in the workflow job to a specific
immutable version or commit SHA, and add persist-credentials: false in the
checkout configuration so the workflow does not retain the default token.

In @.github/workflows/shellcheck.yaml:
- Line 14: The checkout step in this workflow still uses an unpinned actions ref
and does not disable credential persistence, matching the issue noted in
black.yaml. Update the actions/checkout usage in the workflow to a specific
commit SHA or other pinned ref, and add persist-credentials: false on the same
checkout step so it does not leave repo credentials available after the job
runs.

---

Outside diff comments:
In @.github/workflows/e2e_tests.yaml:
- Around line 27-41: The checkout step in the e2e workflow is not hardened
enough: actions/checkout should be pinned to a specific commit SHA, and
persist-credentials should not stay enabled by default. Update the existing
actions/checkout usage in the workflow to reference a verified SHA instead of a
version tag, and change the persist-credentials setting so credentials are
disabled unless a later step explicitly needs git authentication.
- Line 41: The checkout configuration in the e2e workflow is using curly quotes
for the submodules value, which makes it a different literal string. Update the
actions/checkout configuration to use the standard quoted value for submodules
in the workflow so recursive submodule checkout is enabled for
lightspeed-providers.
- Around line 27-41: The e2e_tests workflow uses actions/checkout@v7 with a
pull_request_target fork-head checkout pattern, which is blocked unless
explicitly opted in. Update the checkout step in e2e_tests.yaml to set
allow-unsafe-pr-checkout: true when running under pull_request_target, or
refactor the job to run under an unprivileged pull_request flow; keep the
existing repository, ref, persist-credentials, and submodules settings aligned
with that checkout behavior.