harden: pin action SHAs, fail closed on missing base-ref

[chiruu12]

From the cross-repo review — supply-chain + fail-open hardening for the composite action.

Changes

• Pin third-party actions to commit SHAs (action.yml, ci.yml): astral-sh/setup-uv@…#v7, actions/setup-python@…#v6, actions/checkout@…#v6 — were floating on major tags (supply-chain drift risk).
• Fail closed on a missing base ref (action.yml): new preflight runs git rev-parse --verify origin/<base-ref> and exits 1 with a clear ::error:: if it's absent (shallow checkout or wrong branch). Previously this produced an empty diff and the scan silently passed (exit 0).
• Fix latent malformed YAML in action.yml: the description: contained an unquoted fetch-depth: 0 (: breaks strict YAML parsers); now quoted.
• README: align local-install pin to >=0.4.0,<0.5 (matches the action default).

Notes / follow-ups (tracked as issues)

• The deeper CLI fail-open surface (non-overlapping chunk boundaries, hard .github/ skip) lives in unplug.cli.scan_pr in the SDK and is handled in a separate SDK PR.
• CI still doesn't exercise the composite action end-to-end or assert exit 0 on benign input.

Test plan

• CI green (validate + both functional fixtures)
• Preflight fails clearly when base-ref is missing

[greptile-apps]

Greptile Summary

This PR hardens the composite action and its docs. The main changes are:

• Pins third-party GitHub Actions to commit SHAs.
• Quotes the action metadata description.
• Adds a fail-closed check for missing or invalid base refs.
• Aligns the README local install command with the action version range.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
action.yml	Pins action dependencies, quotes the description, and validates the requested base ref before scanning.
.github/workflows/ci.yml	Pins checkout and setup-python actions while keeping the existing workflow behavior.
README.md	Updates the local CLI install example to use the 0.4 version range.

_{Reviews (3): Last reviewed commit: "use git check-ref-format for base-ref va..." | Re-trigger Greptile}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.