From d74bd530295e5ad419ca4ae84c0e6052ac39ee09 Mon Sep 17 00:00:00 2001 From: Nick Older Date: Wed, 5 Aug 2026 09:55:05 -0400 Subject: [PATCH] Pin GitHub Actions to commit SHAs Pins actions/checkout, pnpm/action-setup, and actions/setup-node to full commit SHAs with version comments instead of floating major tags, for reproducible builds and supply-chain safety. Each SHA is the commit the corresponding release tag currently points at, so CI runs the same code as before. --- .github/workflows/ci.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ced6986..4e72177 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,13 +15,13 @@ jobs: node-version: [20.x, 22.x, 23.x, 24.x, 25.x] fail-fast: false steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install pnpm - uses: pnpm/action-setup@v6 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ matrix.node-version }} cache: "pnpm" @@ -41,13 +41,13 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install pnpm - uses: pnpm/action-setup@v6 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 - name: Use Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: cache: "pnpm"