From 93fdae584b0d42b77e79f11bd517e0005436c09a Mon Sep 17 00:00:00 2001 From: Pavel Tarnopolsky Date: Wed, 12 Aug 2026 11:14:41 +0300 Subject: [PATCH] ci: pin GitHub Actions to commit SHAs --- .github/workflows/claude-code-review.yml | 4 ++-- .github/workflows/claude-docs-drafter.yml | 6 +++--- .github/workflows/claude.yml | 4 ++-- .github/workflows/lint.yml | 4 ++-- .github/workflows/manual-publish.yml | 10 +++++----- .github/workflows/preview-publish.yml | 6 +++--- .github/workflows/security-audit.yml | 4 ++-- .github/workflows/unit-tests.yml | 4 ++-- 8 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 532cdebd..80f7d309 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -28,13 +28,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 1 - name: Run Claude Code Review id: claude-review - uses: anthropics/claude-code-action@beta + uses: anthropics/claude-code-action@28f83620103c48a57093dcc2837eec89e036bb9f # beta with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} diff --git a/.github/workflows/claude-docs-drafter.yml b/.github/workflows/claude-docs-drafter.yml index 8ac1dd62..27bd3c86 100644 --- a/.github/workflows/claude-docs-drafter.yml +++ b/.github/workflows/claude-docs-drafter.yml @@ -25,14 +25,14 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 0 - name: Run Claude Docs Drafter timeout-minutes: 10 id: claude-docs-drafter - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@239e3a730883eeb5c53db12b0fc9573b3024b126 # v1 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} use_sticky_comment: true @@ -122,7 +122,7 @@ jobs: - name: Add docs-draft label if: success() && fromJSON(steps.claude-docs-drafter.outputs.structured_output).needs_docs == true - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 with: script: | // Create the label if it doesn't exist yet diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index e595b4c5..8b6ef14b 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -26,13 +26,13 @@ jobs: actions: read # Required for Claude to read CI results on PRs steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 1 - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@beta + uses: anthropics/claude-code-action@28f83620103c48a57093dcc2837eec89e036bb9f # beta with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 4bfec976..cc6c3834 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -12,10 +12,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Use Node.js 20.x - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: "20.x" cache: "npm" diff --git a/.github/workflows/manual-publish.yml b/.github/workflows/manual-publish.yml index ae75533d..db9bc9b5 100644 --- a/.github/workflows/manual-publish.yml +++ b/.github/workflows/manual-publish.yml @@ -31,14 +31,14 @@ jobs: steps: - name: Generate a token id: generate-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2 with: app-id: ${{ vars.BASE44_GITHUB_ACTIONS_APP_ID }} private-key: ${{ secrets.BASE44_GITHUB_ACTIONS_APP_PRIVATE_KEY }} owner: base44 - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 0 token: ${{ steps.generate-token.outputs.token }} @@ -47,7 +47,7 @@ jobs: run: corepack enable - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 cache: "npm" @@ -115,7 +115,7 @@ jobs: - name: Create Release if: github.event.inputs.dry_run == 'false' - uses: actions/create-release@v1 + uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -139,7 +139,7 @@ jobs: - name: Notify skills repo if: github.event.inputs.dry_run == 'false' && github.event.inputs.notify_skills_repo == 'true' - uses: peter-evans/repository-dispatch@v4 + uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4 with: token: ${{ steps.generate-token.outputs.token }} repository: base44/skills diff --git a/.github/workflows/preview-publish.yml b/.github/workflows/preview-publish.yml index 8cd53fd1..15e99546 100644 --- a/.github/workflows/preview-publish.yml +++ b/.github/workflows/preview-publish.yml @@ -10,13 +10,13 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Enable corepack run: corepack enable - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 cache: "npm" @@ -123,7 +123,7 @@ jobs: fi - name: Comment PR with install instructions - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6 with: script: | const fullPackage = '${{ steps.preview_info.outputs.full_package }}'; diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml index a353173b..a9155cfb 100644 --- a/.github/workflows/security-audit.yml +++ b/.github/workflows/security-audit.yml @@ -18,10 +18,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Use Node.js 20.x - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: "20.x" cache: "npm" diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml index 8f03dd66..7c62e0c7 100644 --- a/.github/workflows/unit-tests.yml +++ b/.github/workflows/unit-tests.yml @@ -12,10 +12,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Use Node.js 20.x - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: "20.x" cache: "npm"