- name: Ensure Node.js available
      uses: actions/setup-node@v4
      with:
        node-version: "20"

The setup-node action is not pinned to a commit hash, which means that the codex-action can't be used from a repository that requires pinned actions (the check is transitive).