harden: pin action SHAs, fail closed on missing base-ref

[chiruu12]

From the cross-repo review — supply-chain + fail-open hardening for the composite action.

Changes

• Pin third-party actions to commit SHAs (action.yml, ci.yml): astral-sh/setup-uv@…#v7, actions/setup-python@…#v6, actions/checkout@…#v6 — were floating on major tags (supply-chain drift risk).
• Fail closed on a missing base ref (action.yml): new preflight runs git rev-parse --verify origin/<base-ref> and exits 1 with a clear ::error:: if it's absent (shallow checkout or wrong branch). Previously this produced an empty diff and the scan silently passed (exit 0).
• Fix latent malformed YAML in action.yml: the description: contained an unquoted fetch-depth: 0 (: breaks strict YAML parsers); now quoted.
• README: align local-install pin to >=0.4.0,<0.5 (matches the action default).

Notes / follow-ups (tracked as issues)

• The deeper CLI fail-open surface (non-overlapping chunk boundaries, hard .github/ skip) lives in unplug.cli.scan_pr in the SDK and is handled in a separate SDK PR.
• CI still doesn't exercise the composite action end-to-end or assert exit 0 on benign input.

Test plan

• CI green (validate + both functional fixtures)
• Preflight fails clearly when base-ref is missing

[greptile-apps]

Greptile Summary

This PR hardens the composite scan action and its CI setup. The main changes are:

• Pins third-party GitHub Actions to commit SHAs.
• Adds a fail-closed check for the configured remote base ref.
• Quotes the action description for stricter YAML parsing.
• Aligns the README local install range with the action default.

Confidence Score: 5/5

This looks safe to merge after a small input-validation cleanup.

• The main hardening path matches the documented short branch-name usage.
• A caller can still pass git revision syntax in base-ref, which changes the checked diff target.
• No blocking issues were found in the changed code.

action.yml

Important Files Changed

Filename	Overview
action.yml	Pins setup actions, quotes the description, and adds the base-ref preflight; the new check still accepts git revision expressions.
.github/workflows/ci.yml	Pins checkout and setup-python actions while preserving the existing validation and scanner tests.
README.md	Updates the local CLI install example to the same compatible 0.4.x package range used by the action.

_{Reviews (1): Last reviewed commit: "harden: pin action SHAs + base-ref prefl..." | Re-trigger Greptile}

[greptile-apps]

Revision Syntax Bypasses Ref Check

When base-ref contains git revision syntax such as main^ or main~1, this check verifies origin/main^ as a valid commit instead of requiring the literal remote branch origin/main. The scan then runs against the caller-supplied revision expression, which can expand the diff to commits outside the PR and produce incorrect scan results.