From 6b7dd6eb1d761e820560a2a33b032ecc7e6a555b Mon Sep 17 00:00:00 2001
From: John Kelly <john.kelly@interchecks.com>
Date: Tue, 16 Jun 2026 11:31:45 -0500
Subject: [PATCH] ci: pin third-party actions to commit SHAs

Tag and branch refs are mutable; pinning third-party actions to full commit
SHAs (with the version preserved in a trailing comment) follows GitHub's
recommended hardening and guards against supply-chain compromise such as the
reviewdog incident. CI-only, no change to entrypoint.sh behavior. Existing
versions are preserved (softprops pinned to the 2.0.0 SHA, not bumped).
Addresses #336.
---
 .github/workflows/lint.yml | 12 ++++++------
 .github/workflows/main.yml |  4 ++--
 .github/workflows/test.yml |  6 +++---
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 22960d6a..84fe4860 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -18,8 +18,8 @@ jobs:
     name: Lint Bash scripts
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: reviewdog/action-shellcheck@v1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1
         with:
           github_token: ${{ secrets.github_token }}
           reporter: github-pr-review
@@ -32,9 +32,9 @@ jobs:
     name: Lint Dockerfiles
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: hadolint
-        uses: reviewdog/action-hadolint@v1
+        uses: reviewdog/action-hadolint@921946a7ebaaf08ac72607bad67209f4e52b5407 # v1
         with:
           reporter: github-pr-review
           level: warning
@@ -44,9 +44,9 @@ jobs:
   lint-actions:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Lint Github Actions
-        uses: reviewdog/action-actionlint@v1
+        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1
         env:
           REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 474fdf81..79a54094 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -18,7 +18,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: "0"
 
@@ -31,7 +31,7 @@ jobs:
           GIT_API_TAGGING: false # uses git cli
 
       - name: automatic-release
-        uses: softprops/action-gh-release@v2.0.0
+        uses: softprops/action-gh-release@a6c7483a42ee9d5daced968f6c217562cd680f7f # v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           tag_name: ${{ steps.tag.outputs.new_tag }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 77d28144..ebf8200c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: '0'
@@ -206,7 +206,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: '0'
@@ -216,7 +216,7 @@ jobs:
 
       - name: Setup Bats
         id: setup-bats
-        uses: bats-core/bats-action@3.0.1
+        uses: bats-core/bats-action@42fcc8700f773c075a16a90eb11674c0318ad507 # 3.0.1
         with:
           support-path: "${{ github.workspace }}/tests/bats-support"
           assert-path: "${{ github.workspace }}/tests/bats-assert"