[ExtraToast]

What changed

• Pins: the add-to-project reference moves from @main to v0.45.0 (f8f0a5ae583913de18143bbbbe0db9ecab970435).
• reusable-without-token: add-to-project passes PACKAGES_PROXY_TOKEN in its secrets: map.
• Proxy setup: setup-package-proxy (token from secrets.PACKAGES_PROXY_TOKEN) runs in ci.yml after checkout and before jdx/mise-action, so mise exec -- task check installs through the proxy. The guard cannot see the mise exec installs, so it reports 0 both before and after.

Guard counts

• Before: 0 findings. After: 0 findings. The guard is in report mode, since it cannot see installs made inside mise exec.

Checked locally with actionlint and the guard. CI is the test.

Refs JorisJonkers-dev/workspace#167