Pin GitHub Actions to commit SHAs

[github-security-bot]

Pins GitHub Actions uses: references in github/copilot-survey-engine to immutable commit SHAs.

Summary

Metric	Count
Files changed	3
Files scanned	2
Refs found	4
Refs pinned	4
Skipped refs	0
Warnings	1
Errors	0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

• Original refs are preserved in inline comments when possible.
• Pin comments use the Dependabot-compatible original-ref style.
• Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
• No minimum action age was enforced for this run.

Pinned refs

Location	Before	After	Resolved as
.github/workflows/dependency-review.yml:14	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/dependency-review.yml:17	actions/dependency-review-action@v5	actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294	branch
.github/workflows/node.js.yml:20	actions/checkout@v3	actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26	tag
.github/workflows/node.js.yml:22	actions/setup-node@v3	actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610	tag

Dependabot

• Added .github/dependabot.yml enabling weekly github-actions updates with a 7-day cooldown (cooldown: default-days: 7).
• The cooldown delays applying a newly published action release for 7 days, reducing exposure to a compromised or broken release while keeping you SHA-pinned.

Warnings

Location	Ref	Reason
.github/workflows/dependency-review.yml:17	actions/dependency-review-action@v5	pinned mutable branch ref 'v5' to a1d282b36b6f; review carefully because the source branch can move

---

Generated by pinner 0.1.0.

[Copilot]

🟢 Approval recommended

All action SHAs match their documented versions, and the Dependabot configuration is valid.

Pull request overview

Pins all GitHub Actions dependencies to immutable SHAs and configures automated updates.

Changes:

• Pins four action references with version comments.
• Adds weekly Dependabot updates with a seven-day cooldown.

File summaries

File	Description
.github/workflows/node.js.yml	Pins checkout and Node setup actions.
.github/workflows/dependency-review.yml	Pins checkout and dependency review actions.
.github/dependabot.yml	Configures GitHub Actions dependency updates.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.