Pin GitHub Actions to commit SHAs

[github-security-bot]

Pins GitHub Actions uses: references in github/gh-stack to immutable commit SHAs.

Summary

Metric	Count
Files changed	4
Files scanned	3
Refs found	8
Refs pinned	8
Skipped refs	0
Warnings	1
Errors	0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

• Original refs are preserved in inline comments when possible.
• Pin comments use the Dependabot-compatible original-ref style.
• Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
• No minimum action age was enforced for this run.

Pinned refs

Location	Before	After	Resolved as
.github/workflows/docs.yml:26	actions/checkout@v4	actions/checkout@11d5960a326750d5838078e36cf38b85af677262	tag
.github/workflows/docs.yml:29	actions/setup-node@v4	actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020	tag
.github/workflows/docs.yml:45	actions/upload-pages-artifact@v3	actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa	tag
.github/workflows/docs.yml:59	actions/deploy-pages@v4	actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e	tag
.github/workflows/release.yml:17	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/release.yml:20	cli/gh-extension-precompile@v2	cli/gh-extension-precompile@76961aa3bd1123d0a6fd42d0a41aca0696937c39	branch
.github/workflows/test.yml:20	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/test.yml:21	actions/setup-go@v6	actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16	tag

Dependabot

• Added .github/dependabot.yml enabling weekly github-actions updates with a 7-day cooldown (cooldown: default-days: 7).
• The cooldown delays applying a newly published action release for 7 days, reducing exposure to a compromised or broken release while keeping you SHA-pinned.

Warnings

Location	Ref	Reason
.github/workflows/release.yml:20	cli/gh-extension-precompile@v2	pinned mutable branch ref 'v2' to 76961aa3bd11; review carefully because the source branch can move

---

Generated by pinner 0.1.0.

[Copilot]

🟢 Approval recommended

All action SHAs resolve to the annotated versions, and the Dependabot configuration is valid.

Pull request overview

Pins all GitHub Actions to verified immutable SHAs and configures Dependabot updates.

Changes:

• Pins eight workflow action references.
• Preserves version annotations for Dependabot.
• Adds weekly updates with a seven-day cooldown.

File summaries

File	Description
.github/workflows/test.yml	Pins test workflow actions.
.github/workflows/release.yml	Pins release workflow actions.
.github/workflows/docs.yml	Pins documentation workflow actions.
.github/dependabot.yml	Configures GitHub Actions updates.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.