Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/go.yml:
- Line 9: The actions/checkout action is currently referenced by version tag
(`@v7`) which uses a mutable reference susceptible to tag tampering. Replace the
`@v7` tag with the full-length commit SHA for the v7.0.0 release (you can find
this on the actions/checkout releases page). Additionally, add the
persist-credentials: false parameter to the checkout action configuration to
prevent credential leakage through workflow artifacts. This combination ensures
the workflow references an immutable commit hash and minimizes security risks
from credential exposure.

In @.github/workflows/ruby.yml:
- Line 8: Replace the actions/checkout@v7 reference with the full commit SHA
(actions/checkout@1d96c772d19495a3b5c516d2bc367d53b965f973) and add a comment
indicating the version for reference. Additionally, add a with block to the
checkout action step that sets persist-credentials to false to prevent the
GITHUB_TOKEN from being stored in Git config, which reduces the risk of
credential exposure in case of job or action compromise.

In `@ci/pipeline-template.yml`:
- Around line 1466-1471: The regexp pattern in the
base-oss-google-ubuntu-stemcell resource uses ubuntu-* which in regex syntax
matches zero or more hyphens rather than acting as a wildcard, preventing it
from matching filenames with OS codenames like ubuntu-noble. Replace the
ubuntu-* portion of the regexp with a proper regex pattern that matches the OS
codename (such as ubuntu-[a-z]+) to correctly match the uploaded artifact
pattern from line 1128, or use the existing template variable pattern pattern
used elsewhere in the file for consistency.
- Around line 1021-1024: The parallel AWS build plan contains an empty do: step
that renders as do: null and violates the Concourse step schema. Remove the
empty - do: line at line 1022 (the line containing just "- do:"). The two
build_light_aws_stemcell_new function calls should remain as direct children of
in_parallel: without being nested inside a do: step, since they are already
properly structured as sibling steps in the parallel execution block.

In `@ci/tasks/light-google/make-raw-from-heavy-stemcell.sh`:
- Line 22: In the conditional statement on line 22 of
make-raw-from-heavy-stemcell.sh, add quotes around the AWS_ACCESS_KEY_ID
variable in the test condition to ensure proper shell quoting. The variable
should be quoted as "$AWS_ACCESS_KEY_ID" within the brackets to maintain
consistency with the strict quoting standards being applied throughout the
hardening effort.

In `@image-metalinks/ubuntu-jammy/ubuntu-jammy.meta4`:
- Line 9: The version element in the ubuntu-jammy.meta4 file is set to 1111.0.0,
which differs significantly from version 142.0.0 used in ubuntu-noble.meta4.
Verify whether the different versions across Ubuntu releases are intentional
based on your release management strategy. If versions should be aligned across
releases, update the version in ubuntu-jammy.meta4 to match ubuntu-noble.meta4
(or vice versa depending on which is correct). If the versions are intentionally
different, document the reason in a comment or commit message to clarify the
versioning scheme for future maintainers.