From 64eff0f85cb3abf8531f986165528226b4900025 Mon Sep 17 00:00:00 2001
From: jchandramouli <71663363+jchandramouli@users.noreply.github.com>
Date: Tue, 18 Nov 2025 22:44:58 +0000
Subject: [PATCH 1/2] security: pin GitHub Actions in
 .github/workflows/validation.yml

Updated 2 GitHub Actions in .github/workflows/validation.yml to use SHA pinning
for improved security and reproducibility.

This change:
- Replaces version tags with specific SHA commits
- Adds version comments for maintainability
- Enhances protection against supply chain attacks

Auto-generated security update for webedx-spark/ts-node-template
---
 .github/workflows/validation.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/validation.yml b/.github/workflows/validation.yml
index 70c3e14..1c6c5fd 100644
--- a/.github/workflows/validation.yml
+++ b/.github/workflows/validation.yml
@@ -9,7 +9,7 @@ jobs:
     steps:
       - uses: actions/checkout@master
       - name: Use Node.js 12.x
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 12.x
       - name: Install dependencies
@@ -22,7 +22,7 @@ jobs:
     steps:
       - uses: actions/checkout@master
       - name: Use Node.js 12.x
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 12.x
       - name: Install dependencies
@@ -30,7 +30,7 @@ jobs:
       - name: Jest
         run: npm run test --coverage
       - name: Send coverage to codecov
-        uses: codecov/codecov-action@v1
+        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           flags: unittests
@@ -41,7 +41,7 @@ jobs:
     steps:
       - uses: actions/checkout@master
       - name: Use Node.js 12.x
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 12.x
       - name: Install dependencies
@@ -55,7 +55,7 @@ jobs:
     steps:
       - uses: actions/checkout@master
       - name: Use Node.js 12.x
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 12.x
       - name: Install dependencies

From c55e1d9a446ddcb38a50185155dc8388aca1b03e Mon Sep 17 00:00:00 2001
From: jayanarayan chandramouli
 <71663363+jchandramouli@users.noreply.github.com>
Date: Wed, 28 Jan 2026 12:37:07 -0800
Subject: [PATCH 2/2] use checkout v4 sha

---
 .github/workflows/validation.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/validation.yml b/.github/workflows/validation.yml
index 1c6c5fd..f533d5f 100644
--- a/.github/workflows/validation.yml
+++ b/.github/workflows/validation.yml
@@ -7,7 +7,7 @@ jobs:
     name: Linting
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Use Node.js 12.x
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with: