feat: restore from full backup snapshot #590

	name: Lint Actions

	on:
	pull_request:
	branches:
	- main
	- release/*
	- releases/*
	push:
	branches:
	- main

	permissions:
	contents: read

	jobs:
	pinact-check:
	name: Check pinned GitHub Actions
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

	- name: Check all actions are SHA-pinned
	run: \|
	FAILED=0
	while IFS= read -r match; do
	[ -z "$match" ] && continue
	file=$(echo "$match" \| cut -d: -f1)
	line=$(echo "$match" \| cut -d: -f2)
	content=$(echo "$match" \| cut -d: -f3-)
	echo "::error file=${file},line=${line}::Unpinned action: ${content}"
	FAILED=1
	done <<< "$(grep -rn '^\s*uses:' .github/workflows/ \
	\| grep -v 'uses: \.' \
	\| grep -vE '@[0-9a-f]{40}')"
	if [ "$FAILED" -eq 1 ]; then
	echo "Fix: replace tags (@v4) with SHA hashes. Run: pinact run"
	exit 1
	fi
	echo "All GitHub Actions are properly SHA-pinned."

	- name: Check all Docker base images are digest-pinned
	run: \|
	FAILED=0
	while IFS= read -r match; do
	[ -z "$match" ] && continue
	file=$(echo "$match" \| cut -d: -f1)
	line=$(echo "$match" \| cut -d: -f2)
	content=$(echo "$match" \| cut -d: -f3-)
	echo "::error file=${file},line=${line}::Unpinned Docker image: ${content}"
	FAILED=1
	done <<< "$(grep -rn '^FROM ' Dockerfile Dockerfile.builder \| grep -v '@sha256:')"
	if [ "$FAILED" -eq 1 ]; then
	echo "Fix: add @sha256: digest to each FROM line."
	exit 1
	fi
	echo "All Docker base images are properly digest-pinned."

Provide feedback