Audit: make shared actions repo visible and consumption-ready

[gambe94]

Why

Consumability audit of this repo as the org's shared uses: target: visibility, discoverability, caller-readiness, supply-chain safety, and versioning.

Already in good shape (no changes needed)

• ✅ Repo is public → cross-repo uses: works without any org Actions "Access" setting
• ✅ Description + topics set; MIT LICENSE, CONTRIBUTING, GETTING_STARTED, docs/
• ✅ README lists every action/workflow with inputs/outputs/permissions; runnable callers in examples/
• ✅ Least-privilege permissions: blocks; OIDC + JWT auth (no PATs); if: always() secret cleanup; dry-run: true defaults
• ✅ actionlint already enforced in CI

Changes

1. Canonical org name — every uses: path and doc referenced the renamed org gforceinnovation (now 404; only a repo redirect keeps it resolving). All references now use Gforce-Innovation-Kft, closing an org-name re-registration hijack vector. Reference snippets point at @v1.
2. Supply-chain pinning — all third-party actions pinned to full commit SHAs with # vX.Y.Z comments (latest release within the currently-used major, so no behavior change); mixed checkout@v4/@v5 normalized; actionlint download pinned to v1.7.12; dependabot.yml added (github-actions + npm, weekly, grouped) to keep pins fresh.
3. Release automation + versioning — new release.yml: pushing vX.Y.Z creates the GitHub Release and force-moves the floating major tag (v1). Strategy documented in README/GETTING_STARTED/CONTRIBUTING: pin @v1 (recommended), @v1.2.0, or a SHA — never @main in production.
4. Injection hardening — ${{ inputs.* }} / step-output interpolations moved out of run: scripts into env: (salesforce-code-analyzer, test-simple, sf-jwt-login); fixed required: true inputs that carry defaults.
5. Governance — .github/CODEOWNERS (@gambe94) and SECURITY.md.

Verification

• npm run all (format + lint + typecheck + bundle + test + dist:verify) ✅
• actionlint 1.7.12 across .github/ — zero findings (fixed one pre-existing SC2086 in test-simple) ✅
• Every pinned SHA resolved directly from its release tag via the GitHub API ✅

Manual follow-ups after merge

1. Sync to main, then create the first release: git tag v1.0.0 && git push origin v1.0.0 (automation creates the Release + v1)
2. Strongly consider re-registering the abandoned gforceinnovation org name as a placeholder
3. Update caller repos to Gforce-Innovation-Kft/...@v1
4. Optional: branch protection on main (require CI + code-owner review)

🤖 Generated with Claude Code