Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Around line 60-63: The gosec security scanner is currently non-blocking due to
the `-no-fail` flag in the args parameter of the securego/gosec action. Remove
the `-no-fail` flag from the args to make security findings enforceable,
ensuring that the job will fail if vulnerabilities are detected rather than just
reporting them without blocking the workflow.
- Around line 46-50: The release workflow gating tests make direct calls to the
live pokeapi.co API through commands like "pokemon pikachu", "pokemon
charizard", "ability overgrow", "move thunderbolt", and "mechanics --natures",
which means transient API or network outages can block releases regardless of
code quality. Replace these live API calls with mocked API responses or
configure the test commands to use a mock server or offline test mode so that
release gating is not dependent on external service availability.
- Around line 10-13: The workflow file grants elevated write permissions
(contents: write, id-token: write, security-events: write) at the top level,
making them available to all jobs unnecessarily. Move these write permissions
from the top-level permissions section into the specific job definitions that
actually require them. First, either remove these elevated permissions from the
top-level permissions block or set them to read-only there, then add a
permissions section within each job that needs elevated access with only the
specific permissions required for that job's tasks.
- Around line 30-33: Replace all mutable version tags in the `uses:` statements
throughout both .github/workflows/release.yml and .github/workflows/security.yml
with their corresponding full commit SHAs. For each action reference (such as
actions/checkout@v6, actions/setup-go@v6, and all others listed in the affected
lines), find the commit SHA for that specific version tag from the action's
GitHub repository and replace the `@v`# tag with the full commit hash. This
applies to all 50 affected lines across both workflow files to ensure
supply-chain security and prevent drift from future changes to those version
tags.

In @.github/workflows/security.yml:
- Around line 16-19: The workflow file uses mutable tag references for GitHub
Actions (actions/checkout@v6, securego/gosec@v2.25.0, actions/setup-python@v6,
and astral-sh/setup-uv@v7) which can silently change upstream. Replace these
mutable version tags with immutable commit SHAs for all occurrences of each
action throughout the file (checkout appears on lines 16 and 28, gosec on line
19, setup-python on line 31, and setup-uv on line 36). Convert each action
reference from the format "action@vX.Y.Z" to "action@<full-commit-sha>" to
ensure reproducible and secure workflow execution.