Every uses: entry in every GitHub Actions workflow across the publicala organization must be pinned to a specific version. This policy defines how to pin, what to pin to, and how to handle future deprecations without accumulating backlogs.

Repositories that follow the feature/ → dev → main workflow enforce merge commit only* when a PR is merged into main. Squash and rebase merges are disabled for that target.