From 8a3bb508dd809c5136316dac5ae554efc6b3301c Mon Sep 17 00:00:00 2001 From: louis Date: Tue, 20 Oct 2026 13:34:06 +0200 Subject: [PATCH] chore(DEVS-1741): pin GitHub Actions to commit SHAs Pin all workflow actions to full commit SHAs per ADR0006. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/node.js.yml | 4 ++-- .github/workflows/publish-npm.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml index d40bfeb..5496155 100644 --- a/.github/workflows/node.js.yml +++ b/.github/workflows/node.js.yml @@ -20,9 +20,9 @@ jobs: # See supported Node.js release schedule at https://nodejs.org/en/about/releases/ steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v6.3.0 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: ${{ matrix.node-version }} - run: npm install diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml index ed79df6..856c798 100644 --- a/.github/workflows/publish-npm.yml +++ b/.github/workflows/publish-npm.yml @@ -10,10 +10,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Setup Node - uses: actions/setup-node@v6.3.0 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 with: node-version: "24" registry-url: "https://registry.npmjs.org"