From 3e2bd1f27c88d0eb9bdddbe7eb8cfe79a3f93ce6 Mon Sep 17 00:00:00 2001 From: raj pandey Date: Thu, 22 Oct 2026 19:03:20 +0530 Subject: [PATCH] chore(ci): pin third-party actions to commit SHAs A tag or branch can be moved to point at different code; a commit SHA cannot. Pin pnpm/action-setup and snyk/actions/node at the commit each workflow already runs, so CI behaviour does not change. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/lint.yml | 2 +- .github/workflows/sca-scan.yml | 2 +- .github/workflows/unit-test.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 165c7ba092..d2b33d62ed 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 with: version: 10.28.0 - uses: actions/setup-node@v4 diff --git a/.github/workflows/sca-scan.yml b/.github/workflows/sca-scan.yml index 79b6557546..b64e71890a 100644 --- a/.github/workflows/sca-scan.yml +++ b/.github/workflows/sca-scan.yml @@ -11,7 +11,7 @@ jobs: steps: - uses: actions/checkout@master - name: Run Snyk to check for vulnerabilities - uses: snyk/actions/node@master + uses: snyk/actions/node@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0 env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} with: diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index 801e352ddb..a1ae2fcf41 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 with: version: 10.28.0 - uses: actions/setup-node@v4