Every external action in `.github/` is now referenced by a 40-character
commit SHA with the release tag as a trailing comment, so a compromised
or retagged upstream release cannot silently change what runs in CI —
this covers 78 `uses:` refs across 15 files, leaving in-repo
`./.github/...` composite-action and reusable-workflow refs as-is since
they are not a supply-chain surface. Each SHA was resolved from the tag
the workflow already floated on and re-verified against the GitHub API,
so the change is behaviour-preserving; all 15 files were also re-checked
as valid YAML.
Two pins are worth a reviewer's attention:
- **`pnpm/action-setup` is pinned to v4.3.0, not v4.4.0.** Upstream's
`v4.4.0` tag points at the same commit as `v5.0.0`, while the floating
`v4` tag we were on still resolves to v4.3.0 — pinning to v4.4.0 would
have silently jumped a major.
- **`actions/checkout@v3` and `actions/create-github-app-token@v1` are
pinned at their latest v3/v1 SHAs rather than bumped** to v4/v2, keeping
this PR to pinning alone; bumping those majors is a good follow-up.
A second commit unifies `dorny/paths-filter`, which was the one action
already pinned (at v3.0.3 in the Dependabot changeset workflow) and
would otherwise have left the repo carrying two SHAs for the same
action; its comment justified the pin as being "rather than floating on
`v3`", which no longer distinguishes it now that everything is pinned,
so it is rewritten to keep only the still-relevant `pull_request_target`
warning.
One gap this PR does not close: there is no `.github/dependabot.yml` in
the repo, so nothing will keep these SHAs current and they will drift
away from upstream security fixes — adding a `github-actions` ecosystem
entry (which understands SHA pins with version comments and bumps both)
is worth doing separately. No SDK or CLI package is touched, so no
changeset is needed.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Mish Ushakov
6cce3fde9d