From b9b5e531c0c85a7df522c2c1b090d2b0f01bf9f9 Mon Sep 17 00:00:00 2001
From: ben-bot-ai <351504877+ben-bot-ai@users.noreply.github.com>
Date: Mon, 2 Nov 2026 21:55:59 +0800
Subject: [PATCH] =?UTF-8?q?ci:=20=E5=9B=BA=E5=AE=9A=20GitHub=20Actions=20?=
 =?UTF-8?q?=E5=88=B0=20commit=20SHA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

为什么：awesome-ai-plugins 的收录扫描按未固定 Action 引用扣分，源码仓库仅 73/100，低于 75 的合并门槛；把 11 处引用固定到不可变 commit SHA 后为 80/100。仅改引用形式，版本与运行行为不变。
---
 .github/workflows/ci.yml       |  4 ++--
 .github/workflows/publish.yml  |  4 ++--
 .github/workflows/security.yml | 14 +++++++-------
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 226b27f..b55e357 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,8 +9,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24.9.0
           cache: npm
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index a71ae93..06d21f8 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -52,14 +52,14 @@ jobs:
           }
           NODE
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           # 明确读取标签，避免把同名分支当成待发布版本。
           ref: refs/tags/${{ inputs.tag }}
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: '24.9.0'
           registry-url: https://registry.npmjs.org
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 5176690..ea191b1 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -9,8 +9,8 @@ jobs:
   npm-audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24.9.0
           cache: npm
@@ -24,22 +24,22 @@ jobs:
       actions: read
       security-events: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
         with:
           languages: javascript-typescript
       - name: Run CodeQL
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
 
   secrets-scan:
     name: Secrets scan (gitleaks)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
       - name: Run gitleaks
-        uses: gitleaks/gitleaks-action@v3
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}