harden: default allow-external-refs to false in the actions#128

Merged

reuvenharrison merged 3 commits into

mainfrom

chore/default-external-refs-false

May 30, 2026

Commits on May 30, 2026

harden: default allow-external-refs to false in the actions

reuvenharrison
and
claude
committed
actions: emit a recovery hint when external $refs are blocked

reuvenharrison
and
claude
committed
actions: detect disallowed external $ref by exit code 123, not message text

reuvenharrison
and
claude
committed