From 85ddd64d2b2316e82f9c896ef86892f332d81800 Mon Sep 17 00:00:00 2001 From: David Gilman Date: Tue, 31 Mar 2026 18:01:57 -0700 Subject: [PATCH] fix: pin all GitHub Actions to commit SHAs Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/CI.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml index d5e29e7d..0de17d44 100644 --- a/.github/workflows/CI.yml +++ b/.github/workflows/CI.yml @@ -17,14 +17,14 @@ jobs: steps: - name: Check out Git repository - uses: actions/checkout@v2 + uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 with: ref: ${{ github.event.pull_request.head.ref || '' }} token: ${{ secrets.github_token }} persist-credentials: false - name: Set up node - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 with: node-version: "18.x" registry-url: https://registry.npmjs.org @@ -33,7 +33,7 @@ jobs: id: yarn-cache-dir-path run: echo "::set-output name=dir::$(yarn cache dir)" - - uses: actions/cache@v3 + - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`) with: path: ${{ steps.yarn-cache-dir-path.outputs.dir }}