chore: pin GitHub Actions to SHA refs

[kthy]

Summary

Pin GitHub Actions to full SHA refs for supply-chain security.

Pinned actions

• actions/checkout@v2 → de0fac2 (v6.0.2)
• actions/cache@v1 → 6682284 (v5.0.4)
• actions/upload-artifact@master → bbbca2d (v7.0.0)

🤖 Generated by audit-actions --create-prs

Summary by CodeRabbit

• Chores
  • CI/CD workflow configurations updated to pin action steps to specific commit SHAs for improved stability and supply-chain security. No functional workflow behavior or public APIs were changed.

[coderabbitai]

📝 Walkthrough

Walkthrough

Updated three GitHub Actions step references in .github/workflows/R-CMD-check.yaml from tag-based versions to pinned commit-SHA versions for actions/checkout, actions/cache, and actions/upload-artifact.

Changes

Cohort / File(s)	Summary
Workflow step pinning \.github/workflows/R-CMD-check.yaml	Replaced uses values for actions/checkout, actions/cache, and actions/upload-artifact from tag-based refs (v2, v1, master) to specific commit SHAs (de0fac2e..., 66822842..., bbbca2dd...). No other workflow logic changed.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 I hopped through YAML with a careful paw,
Three action refs fixed to commits I saw,
No more drifting tags, just exacting names,
The workflow's steady now across all lanes. 🥕

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'chore: pin GitHub Actions to SHA refs' clearly and concisely describes the main change: pinning GitHub Actions to commit SHA references for security purposes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/pin-github-actions

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/R-CMD-check.yaml (1)

34-34: Consider pinning r-lib actions for complete supply-chain security.

The PR pins actions/* to SHA refs for supply-chain security, but r-lib/actions/setup-r@master and r-lib/actions/setup-pandoc@master remain unpinned. Using @master means these actions can change without notice, which contradicts the security objective of this PR.

For consistent supply-chain hardening, consider pinning these to SHA refs as well.

🔒 Suggested approach for pinning r-lib actions

First, identify the current commit SHAs for the master branch:

#!/bin/bash
# Get current master commit for r-lib/actions
git ls-remote https://github.com/r-lib/actions.git HEAD

Then update the workflow to use those SHAs with comments:

-      - uses: r-lib/actions/setup-r@master
+      - uses: r-lib/actions/setup-r@<SHA_HERE> # master

-      - uses: r-lib/actions/setup-pandoc@master
+      - uses: r-lib/actions/setup-pandoc@<SHA_HERE> # master

Also applies to: 38-38

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/R-CMD-check.yaml at line 34, Replace unpinned r-lib
actions by pinning their commit SHAs: update the uses entries for
r-lib/actions/setup-r@master and r-lib/actions/setup-pandoc@master to use the
corresponding full commit SHA refs (e.g., r-lib/actions/setup-r@<sha> and
r-lib/actions/setup-pandoc@<sha>), obtaining the SHAs with git ls-remote or from
the actions repo, and include a short comment noting the pinned SHA for
supply-chain traceability; ensure both occurrences (setup-r and setup-pandoc)
are updated consistently.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/workflows/R-CMD-check.yaml:
- Line 34: Replace unpinned r-lib actions by pinning their commit SHAs: update
the uses entries for r-lib/actions/setup-r@master and
r-lib/actions/setup-pandoc@master to use the corresponding full commit SHA refs
(e.g., r-lib/actions/setup-r@<sha> and r-lib/actions/setup-pandoc@<sha>),
obtaining the SHAs with git ls-remote or from the actions repo, and include a
short comment noting the pinned SHA for supply-chain traceability; ensure both
occurrences (setup-r and setup-pandoc) are updated consistently.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3da4d811-42fc-4ebf-8ca9-b221829bd99f

📥 Commits

Reviewing files that changed from the base of the PR and between 13a062d and 00ddebc.

📒 Files selected for processing (1)

• .github/workflows/R-CMD-check.yaml