[codeling]

Why

The workflows use actions/checkout@v7 and shivammathur/setup-php@v2. A tag can be moved by whoever controls the action's repository (or whoever takes it over); the next run of our workflows would then execute what they put there - with this repository's token, in its checkouts, and in the jobs that install and test the release code. Pinning to a commit SHA makes the workflow run exactly what was reviewed.

Change

• All 16 references (ci.yml, dependencies.yml) are pinned, with the release in a comment so the pins stay readable:
  • actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 (what v7 pointed to)
  • shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 (the commit v2 pointed to; resolved with git ls-remote, annotated tag dereferenced)
• tests/lint/check-workflows.php, run by the lint job, fails on any uses: that is not pinned to a 40-character SHA or lacks the release comment (local ./ actions excluded). I checked that it fails on an unpinned reference. The script is identical in com_bfstop (separate PR there).
• Updates: the existing Dependabot github-actions entry proposes pin updates (it understands @sha # vX.Y.Z).

No change to what the workflows do. The runs of this PR are the proof that the pinned commits work.

---

Generated by Claude Code

[codeling]

If integration jobs fail here on ComponentTest::testEntriesOfTheEditFormsAreStoredInCanonicalForm, it is not this PR's: the test came in with #240 and needs codeling/com_bfstop#21 (the component's table check() storing canonical entries), which is not merged yet. CI installs com_bfstop from its main. Details in #243. Merging com_bfstop#21 fixes it for all bfstop PRs and main; I'll re-run the failed jobs after that.

---

Generated by Claude Code

[codeling]

Update on the integration failures here: com_bfstop#21 is merged, but the re-run still fails on the same test (ComponentTest::testEntriesOfTheEditFormsAreStoredInCanonicalForm). The cause is not just the unmerged PR: CI installs the com_bfstop branch with the same name as the PR branch if there is one (ci.yml, "Determine com_bfstop branch"), and com_bfstop still has a pin-actions branch from its merged PR #22, cut before #21. So this PR gets the old component.

Fix: delete the merged branch pin-actions in codeling/com_bfstop (it is fully contained in its main), then re-run the failed jobs. I tried to delete it myself but the delete was blocked, so it needs the repository owner. No code change is needed in this PR.

---

Generated by Claude Code