43cde32d3d
- Pin Dockerfile.alpine to SHA digest (PinnedDependenciesID) - Narrow workflow-level permissions to contents:read (TokenPermissionsID) - Elevated permissions only on release-draft and verify jobs