CI/CD rule updates

Author: szokeasaurusrex

.cursor/rules/cicd-patterns.mdc

@@ -6,6 +6,24 @@ alwaysApply: false
 
 # CI/CD Workflow Guidelines
 
+## Security: Pin Actions by Commit Hash
+
+**ALWAYS pin GitHub Actions to specific commit SHAs** instead of version tags for enhanced security. This prevents supply chain attacks where tags could be moved to malicious commits.
+
+Example:
+
+```yaml
+# ✅ CORRECT - Pinned by hash with version comment
+- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
+- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # 4.6.2
+
+# ❌ INCORRECT - Using version tag
+- uses: actions/checkout@v4
+- uses: actions/upload-artifact@v4.6.2
+```
+
+The comment after the hash helps maintainability by showing which version is pinned.
+
 ## Reusable Workflow Pattern
 
 - Main `ci.yml` calls separate workflows (`lint.yml`, `test.yml`, etc.)