setup-firebase-hosting

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The GitHub Actions workflow includes runtime "uses:" references that pull and execute remote action code (e.g., actions/checkout@11d5960a326750d5838078e36cf38b85af677262, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02, actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093, FirebaseExtended/action-hosting-deploy@500ac625ca2dd40cbd15f7659af953801858032a), which are required runtime dependencies that fetch and run external code.