From af99c131aeda3d5674f3fee3705e271d800fbab2 Mon Sep 17 00:00:00 2001 From: Patrik Weiskircher Date: Mon, 8 Jun 2026 15:11:52 +0000 Subject: [PATCH] chore: pin GitHub Actions dependencies Pin external GitHub Actions used by CI and publishing workflows to verified full-length commit SHAs while keeping the referenced v4 behavior visible in workflow comments. This prevents the workflows from executing code from mutable action tags while preserving the existing checkout and Node setup behavior. Change-Id: Id349b7e50205853c8b793482c563222b3c41959b --- .github/workflows/ci.yml | 4 ++-- .github/workflows/publish.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2f3d746..b5cbf65 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,10 +15,10 @@ jobs: node-version: [18, 20, 22] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: ${{ matrix.node-version }} cache: 'npm' diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index ee4809c..a19483f 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -13,10 +13,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: '20' registry-url: 'https://registry.npmjs.org'