Paid services on Base matching “self-hosted”

Lint a GitHub Actions workflow: actions not pinned to a commit SHA, missing or write-all permissions, pull_request_target with PR head checkout, script injection via event fields in run, secrets on the command line, curl|bash, self-hosted runners, deprecated set-output.

Look up a Base wallet address: native ETH plus balances for a curated list of 195 tokens, read directly from Base chain state via public RPC with a self-hosted reader (no third-party data API). The response includes a coverage field: tokens outside the list with no transfers in the discovery window (default about 28 hours) are not reported. Balances only; no USD valuation.