fix(#255): add required app_location to cleanup-staging close steps

.github/workflows/ci.yml

@@ -89,7 +89,7 @@ jobs:
           VITE_SUPABASE_ANON_KEY: ${{ vars.VITE_SUPABASE_ANON_KEY }}
       - name: Deploy to Azure Static Web Apps
         id: builddeploy
-        uses: Azure/static-web-apps-deploy@v1
+        uses: Azure/static-web-apps-deploy@1a947af9992250f3bc2e68ad0754c0b0c11566c9  # v1
         with:
           azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_WHITE_ISLAND_090DFD003 }}
           repo_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cleanup-staging.yml

@@ -19,15 +19,17 @@ jobs:
     steps:
       - name: Close Pull Request
         id: close1
-        uses: Azure/static-web-apps-deploy@v1
+        uses: Azure/static-web-apps-deploy@1a947af9992250f3bc2e68ad0754c0b0c11566c9  # v1
         continue-on-error: true
         with:
           azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_WHITE_ISLAND_090DFD003 }}
           action: "close"
+          app_location: "app/dist"
 
       - name: Retry close (if first attempt failed)
         if: steps.close1.outcome == 'failure'
-        uses: Azure/static-web-apps-deploy@v1
+        uses: Azure/static-web-apps-deploy@1a947af9992250f3bc2e68ad0754c0b0c11566c9  # v1
         with:
           azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_WHITE_ISLAND_090DFD003 }}
           action: "close"
+          app_location: "app/dist"

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to Workout Lens are documented here.
 
+## [1.5.12] — 2026-05-16
+
+### Security
+- **Pin `Azure/static-web-apps-deploy` to commit SHA (issue #255)** — both `ci.yml` and `cleanup-staging.yml` referenced `Azure/static-web-apps-deploy@v1`, a mutable tag that could be silently updated to run arbitrary code in CI. Pinned to the exact commit SHA (`1a947af`) that `v1` currently resolves to.
+
 ## [1.5.11] — 2026-05-16
 
 ### Developer / Infrastructure