Report a vulnerability in the actions or the image privately through GitHub's security advisories, not in a public issue.

• main changes only through squash-merged pull requests that pass test.yml.
• Only the release-please app creates v* tags. Consumers pin a full commit, so a moved tag never changes what they run.
• Every action this repository uses is pinned to a full commit.
• setup-orca and the image download Orca from the releases of stablyai/orca over HTTPS.