Resolve code-scanning findings

.github/workflows/ci.yml

@@ -2,37 +2,45 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, dev]
     paths-ignore:
       - 'public/events.json' # data commits from the ingest bot don't need a rebuild check
       - '**.md'
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '20'
-          cache: npm
 
-      - run: npm ci
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+
+      - run: bun install --frozen-lockfile
 
       # Parser tests run first and need no install -- fastest signal on the
       # thing most likely to break (upstream format changes).
       - name: Parser tests
-        run: npm run test:parse
+        run: bun run test:parse
 
       - name: Lint
-        run: npm run lint
+        run: bun run lint
 
       - name: Build
-        run: npm run build
+        run: bun run build
 
       - name: Validate committed data
-        run: npm run validate
+        run: bun run validate

.github/workflows/ingest.yml

@@ -1,7 +1,7 @@
 name: Ingest hackathons
 
-# Refreshes public/events.json from the upstream sources and commits it.
-# Netlify's GitHub integration then rebuilds automatically on that commit.
+# Refreshes public/events.json on dev. A reviewed dev-to-main PR promotes the
+# new feed to production after CI passes.
 #
 # Cost: $0. GitHub Actions is free for public repos, and this runs well inside
 # the free minutes for private ones (~4 runs/day at well under a minute each).
@@ -26,21 +26,27 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: dev
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '20'
 
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+
       # Parsers are gated first: never publish data produced by broken logic.
       - name: Test parsers
-        run: node scripts/test-parse.mjs
+        run: bun run test:parse
 
       - name: Fetch and normalize
-        run: node scripts/ingest.mjs
+        run: bun run ingest
 
       - name: Validate output
-        run: node scripts/validate.mjs
+        run: bun run validate
 
       - name: Commit if changed
         run: |