From 5f8d0ca3c38eb7f59bf6efef54595fde74697e2d Mon Sep 17 00:00:00 2001 From: Ling Bao Date: Thu, 11 Jun 2026 18:09:50 +1000 Subject: [PATCH] ci(security): SHA-pin GitHub Actions uses: refs in publish.yml (SEC-06) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pin actions/checkout, actions/setup-java, actions/setup-node to immutable commit SHAs per 26-02 ยง2c. Config-only change; no-release proof recorded in 28-04 (C1-C6 PASS, EXISTS=true). Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/publish.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a84eb98..af9fd21 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -19,12 +19,12 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 (v4.3.1) with: fetch-depth: 0 - name: Set up JDK - uses: actions/setup-java@v4 + uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 (v4.8.0) with: java-version: '8' distribution: 'temurin' @@ -91,7 +91,7 @@ jobs: - name: Set up Node.js if: steps.check.outputs.EXISTS == 'false' - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 (v4.4.0) with: node-version: '20'