Pin GitHub Actions to commit SHAs

[github-security-bot]

Pins GitHub Actions uses: references in github/maintainermonth to immutable commit SHAs.

Summary

Metric	Count
Files changed	5
Files scanned	4
Refs found	8
Refs pinned	8
Skipped refs	0
Warnings	0
Errors	0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

• Original refs are preserved in inline comments when possible.
• Pin comments use the Dependabot-compatible original-ref style.
• Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
• No minimum action age was enforced for this run.

Pinned refs

Location	Before	After	Resolved as
.github/workflows/build-deploy.yml:16	actions/checkout@v3	actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26	tag
.github/workflows/build-deploy.yml:19	actions/setup-node@v2	actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8	tag
.github/workflows/event-submission-check.yml:25	actions/checkout@v4	actions/checkout@11d5960a326750d5838078e36cf38b85af677262	tag
.github/workflows/event-submission-check.yml:28	actions/setup-node@v4	actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020	tag
.github/workflows/event-submission-pr.yml:25	actions/checkout@v4	actions/checkout@11d5960a326750d5838078e36cf38b85af677262	tag
.github/workflows/event-submission-pr.yml:31	actions/setup-node@v4	actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020	tag
.github/workflows/test.yml:15	actions/checkout@v3	actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26	tag
.github/workflows/test.yml:18	actions/setup-node@v2	actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8	tag

Dependabot

• Added .github/dependabot.yml enabling weekly github-actions updates with a 7-day cooldown (cooldown: default-days: 7).
• The cooldown delays applying a newly published action release for 7 days, reducing exposure to a compromised or broken release while keeping you SHA-pinned.

---

Generated by pinner 0.1.0.

[Copilot]

🟢 Approval recommended

All action references are validly SHA-pinned and the Dependabot configuration supports ongoing secure updates.

Pull request overview

Pins GitHub Actions to immutable SHAs and configures Dependabot to keep them updated safely.

Changes:

• Pins eight action references with version comments.
• Adds weekly Dependabot updates with a seven-day cooldown.

File summaries

File	Description
.github/workflows/build-deploy.yml	Pins build/deploy actions.
.github/workflows/event-submission-check.yml	Pins event validation actions.
.github/workflows/event-submission-pr.yml	Pins event PR actions.
.github/workflows/test.yml	Pins test workflow actions.
.github/dependabot.yml	Configures GitHub Actions updates.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.