From 1179ad560e182a690afe6ade5d1c55c7f41100b9 Mon Sep 17 00:00:00 2001
From: Mark Ridgwell <273118822+dnyw4l3n13@users.noreply.github.com>
Date: Thu, 23 Jul 2026 06:22:56 +0000
Subject: [PATCH 1/2] chore(#728): add placeholder changelog entry for Actions
 SHA pinning

Scaffolding commit ahead of pinning the geoipupdate.yml uses: references
to immutable commit SHAs.

Prompt: Work on issue #728 in credfeto/scripts.
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 28818ba6..940eab52 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ Please ADD ALL Changes to the UNRELEASED SECTION and not a specific release
 
 ## [Unreleased]
 ### Security
+- Pin GitHub Actions uses: references to commit SHAs instead of mutable tags in geoipupdate.yml
 ### Added
 - fetch: added --switch-to-main flag to switch to the default branch and rebase it when not on it, skipping if there are uncommitted changes
 - git/ignore-changelog: script to add CHANGELOG.md to .markdownlintignore across git repositories

From b4dbdcd8c13cee208aad835fa82ac698ea074414 Mon Sep 17 00:00:00 2001
From: Mark Ridgwell <273118822+dnyw4l3n13@users.noreply.github.com>
Date: Thu, 23 Jul 2026 11:51:49 +0000
Subject: [PATCH 2/2] chore(#728): pin GitHub Actions uses: references to
 commit SHA in geoipupdate.yml

Pins actions/checkout, credfeto/action-dotnet-version-detect,
actions/setup-dotnet, and stefanzweifel/git-auto-commit-action to their
immutable commit SHAs (with the released tag as a trailing comment) so a
compromised or repointed upstream tag cannot silently change what runs.
---
 .github/workflows/geoipupdate.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/geoipupdate.yml b/.github/workflows/geoipupdate.yml
index 23fadd1e..680a47d3 100644
--- a/.github/workflows/geoipupdate.yml
+++ b/.github/workflows/geoipupdate.yml
@@ -17,15 +17,15 @@ jobs:
 
     steps:
       - name: "Get Latest source"
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ github.head_ref }}
           token: ${{ secrets.SOURCE_PUSH_TOKEN }}
       - name: "Detect dotnet version"
-        uses: credfeto/action-dotnet-version-detect@v1.3.0
+        uses: credfeto/action-dotnet-version-detect@d572bbd7285038bda731c8a4f237b9b8e64a9954 # v1.3.0
       - name: "Install dotnet"
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
         env:
           GITHUB_TOKEN: ${{ secrets.SOURCE_PUSH_TOKEN }}
         with:
@@ -70,7 +70,7 @@ jobs:
         env:
           CURRENT_DATE: ${{steps.time.outputs.CURRENT_DATE}}
       - name: "Commit changes"
-        uses: stefanzweifel/git-auto-commit-action@v7
+        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7
         with:
           commit_message: "[GEOIP] - Updated GEOIP DB from MaxMind (${{steps.time.outputs.CURRENT_DATE}})"
           file_pattern: "*.mmdb CHANGELOG.md"