From 7a465a6b7c94bababae6959b72202872470928af Mon Sep 17 00:00:00 2001 From: Fabian Gonzalez Date: Thu, 15 Oct 2026 22:22:00 -0400 Subject: [PATCH] ci: pin GitHub Actions to full-length commit SHAs Pin all `uses:` references in workflows and composite actions to full commit SHAs, keeping the original ref as a trailing comment (e.g. `actions/checkout@ # v4.2.2`). Generated with pinact v5.0.0 and verified with `pinact run --check --verify-comment`. --- .github/workflows/npm-publish.yml | 4 ++-- .github/workflows/pr.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index e20cf26..78d7d4c 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -9,9 +9,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v2.1.0 + uses: actions/checkout@01aecccf739ca6ff86c0539fbc67a7a5007bbc81 # v2.1.0 - name: Set up Node.js - uses: actions/setup-node@v1 + uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6 with: node-version: 16.17.0 - name: Publish if version has been updated diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index a9761ba..c5bb995 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -10,9 +10,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v2.1.0 + uses: actions/checkout@01aecccf739ca6ff86c0539fbc67a7a5007bbc81 # v2.1.0 - name: Set up Node.js - uses: actions/setup-node@v1 + uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6 with: node-version: 16.17.0 - run: npm install