Pin GitHub Actions to commit SHAs

[github-security-bot]

Pins GitHub Actions uses: references in github/gh-runtime-cli to immutable commit SHAs.

Summary

Metric	Count
Files changed	3
Files scanned	2
Refs found	4
Refs pinned	4
Skipped refs	0
Warnings	1
Errors	0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

• Original refs are preserved in inline comments when possible.
• Pin comments use the Dependabot-compatible original-ref style.
• Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
• No minimum action age was enforced for this run.

Pinned refs

Location	Before	After	Resolved as
.github/workflows/ci.yml:17	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/ci.yml:19	actions/setup-go@v6	actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16	tag
.github/workflows/release.yml:15	actions/checkout@v4	actions/checkout@11d5960a326750d5838078e36cf38b85af677262	tag
.github/workflows/release.yml:21	cli/gh-extension-precompile@v2	cli/gh-extension-precompile@76961aa3bd1123d0a6fd42d0a41aca0696937c39	branch

Dependabot

• Added a github-actions entry (weekly updates, 7-day cooldown) to the existing Dependabot configuration.
• The cooldown delays applying a newly published action release for 7 days, reducing exposure to a compromised or broken release while keeping you SHA-pinned.

Warnings

Location	Ref	Reason
.github/workflows/release.yml:21	cli/gh-extension-precompile@v2	pinned mutable branch ref 'v2' to 76961aa3bd11; review carefully because the source branch can move

---

Generated by pinner 0.1.0.

[Copilot]

🔵 Needs a closer look

The release action SHA resolved from a mutable branch requires human provenance verification.

Pull request overview

Pins GitHub Actions to immutable SHAs and configures automated action updates.

Changes:

• Pins four workflow action references.
• Adds weekly Dependabot updates with a seven-day cooldown.

File summaries

File	Description
.github/workflows/ci.yml	Pins CI actions.
.github/workflows/release.yml	Pins release actions.
.github/dependabot.yml	Adds GitHub Actions updates.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.