Harden public showcase privacy controls

.github/workflows/public-safety.yml

@@ -11,14 +11,17 @@ jobs:
   privacy-and-secret-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
       - name: Check public-safe content
         run: python3 scripts/check-public-safety.py
 
+      - name: Compile detector source
+        run: python3 -m py_compile scripts/check-public-safety.py
+
       - name: Scan Git history for secrets
-        uses: gitleaks/gitleaks-action@v2
+        uses: gitleaks/gitleaks-action@dcedce43c6f43de0b836d1fe38946645c9c638dc # v2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}