From 4a9d01ac325c23209faf59cae37710278c6895ab Mon Sep 17 00:00:00 2001
From: Derek Cofausper <256792747+decofe@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:16:18 +0000
Subject: [PATCH 1/5] chore: add GitHub Actions scan workflow

---
 .github/workflows/scan-github-actions.yml | 24 +++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 .github/workflows/scan-github-actions.yml

diff --git a/.github/workflows/scan-github-actions.yml b/.github/workflows/scan-github-actions.yml
new file mode 100644
index 00000000..733031a5
--- /dev/null
+++ b/.github/workflows/scan-github-actions.yml
@@ -0,0 +1,24 @@
+name: Scan GitHub Actions
+
+on:
+  pull_request:
+    paths:
+      - ".github/**"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/**"
+  schedule:
+    - cron: "17 9 * * 1"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  scan:
+    if: ${{ github.event_name != 'schedule' || github.repository == 'tempoxyz/accounts' }}
+    uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@512158c4e90e42eef8aa7fc3fc3186a79b5b4648 # main
+    permissions:
+      actions: read
+      contents: read

From 193743a4f96c2665863e8cb6b1035679081999f3 Mon Sep 17 00:00:00 2001
From: Derek Cofausper <256792747+decofe@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:30:49 +0000
Subject: [PATCH 2/5] fix(ci): satisfy GitHub Actions scanner

---
 .github/workflows/main.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index b5e056d6..5621b22c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -43,7 +43,7 @@ jobs:
 
       - name: Create or update release pull request
         id: changesets
-        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # 06245a4e0a36c064a573d4150030f5ec548e4fcc
+        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1.8.0
         with:
           commitMode: github-api
           title: 'chore: version packages'
@@ -65,7 +65,7 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -75,7 +75,7 @@ jobs:
           skip-cache: 'true' # avoid cache poisoning attacks
 
       - name: Publish to npm
-        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # 06245a4e0a36c064a573d4150030f5ec548e4fcc
+        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1.8.0
         with:
           publish: pnpm changeset:publish
         env:

From 410d97ee697cb79bb7c90ead09f08570a8b9e619 Mon Sep 17 00:00:00 2001
From: Derek Cofausper <256792747+decofe@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:30:50 +0000
Subject: [PATCH 3/5] fix(ci): satisfy GitHub Actions scanner

---
 .github/workflows/deploy-workers.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-workers.yml b/.github/workflows/deploy-workers.yml
index aabad3ea..22915b28 100644
--- a/.github/workflows/deploy-workers.yml
+++ b/.github/workflows/deploy-workers.yml
@@ -50,7 +50,9 @@ jobs:
         working-directory: ${{ matrix.worker.directory }}
         run: |
           if [ -n "$BUILD_ENV" ]; then
-            export ${BUILD_ENV}
+            while IFS='=' read -r name value; do
+              export "$name=$value"
+            done <<< "$BUILD_ENV"
           fi
           pnpm build
         env:

From 3fa895b5751bafac98632302b27674ccf21b8675 Mon Sep 17 00:00:00 2001
From: Derek Cofausper <256792747+decofe@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:30:52 +0000
Subject: [PATCH 4/5] fix(ci): satisfy GitHub Actions scanner

---
 .github/workflows/verify.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 21d4bf80..fb0f842a 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -89,7 +89,7 @@ jobs:
 
       - name: Run tests
         run: |
-          if [[ "${{ matrix.tag }}" == sha-* ]]; then
+          if [[ "$VITE_NODE_TAG" == sha-* ]]; then
             pnpm test src/server/internal/handlers/multisig.localnet.test.ts --bail=1
           else
             pnpm test --bail=1

From 31ec509f8a64e267d911825eaf8a010c4cd3b0b3 Mon Sep 17 00:00:00 2001
From: Derek Cofausper <256792747+decofe@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:34:18 +0000
Subject: [PATCH 5/5] fix(ci): skip empty build environment lines

---
 .github/workflows/deploy-workers.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-workers.yml b/.github/workflows/deploy-workers.yml
index 22915b28..59423c91 100644
--- a/.github/workflows/deploy-workers.yml
+++ b/.github/workflows/deploy-workers.yml
@@ -51,7 +51,9 @@ jobs:
         run: |
           if [ -n "$BUILD_ENV" ]; then
             while IFS='=' read -r name value; do
-              export "$name=$value"
+              if [ -n "$name" ]; then
+                export "$name=$value"
+              fi
             done <<< "$BUILD_ENV"
           fi
           pnpm build