From 401ef440c5b74495d08cadc0ce012714ee883163 Mon Sep 17 00:00:00 2001 From: "sharp-resolver[bot]" Date: Wed, 5 Aug 2026 10:07:25 -0400 Subject: [PATCH] ci: SHA-pin all floating actions checkout/setup-python/setup-node moved from @v7 tags to full commit SHAs (fleet convention, see api-adapters). A moved tag can no longer change what the publish pipeline executes. Type: ci Co-Authored-By: Claude Fable 5 --- .github/workflows/publish.yml | 8 ++++---- .github/workflows/test.yml | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a0ab921..f15d431 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -19,9 +19,9 @@ jobs: node-version: ["18", "20", "22"] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 with: node-version: ${{ matrix.node-version }} @@ -37,9 +37,9 @@ jobs: id-token: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 with: node-version: "20" registry-url: "https://registry.npmjs.org" diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 957f14d..1ad083c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -14,9 +14,9 @@ jobs: node-version: ["18", "20", "22"] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 with: node-version: ${{ matrix.node-version }}