Pin GitHub Actions to commit SHAs

[github-security-bot]

Pins GitHub Actions uses: references in github/octocatalog-diff to immutable commit SHAs.

Summary

Metric	Count
Files changed	5
Files scanned	4
Refs found	7
Refs pinned	7
Skipped refs	0
Warnings	0
Errors	0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

• Original refs are preserved in inline comments when possible.
• Pin comments use the Dependabot-compatible original-ref style.
• Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
• No minimum action age was enforced for this run.

Pinned refs

Location	Before	After	Resolved as
.github/workflows/add-dependabot-pr-to-project.yml:18	actions/add-to-project@v1.0.2	actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e	tag
.github/workflows/generate-dependabot.yml:17	actions/checkout@v4	actions/checkout@11d5960a326750d5838078e36cf38b85af677262	tag
.github/workflows/main.yml:19	actions/checkout@v4	actions/checkout@11d5960a326750d5838078e36cf38b85af677262	tag
.github/workflows/main.yml:40	actions/checkout@v4	actions/checkout@11d5960a326750d5838078e36cf38b85af677262	tag
.github/workflows/main.yml:61	actions/checkout@v4	actions/checkout@11d5960a326750d5838078e36cf38b85af677262	tag
.github/workflows/main.yml:82	actions/checkout@v4	actions/checkout@11d5960a326750d5838078e36cf38b85af677262	tag
.github/workflows/release.yml:16	actions/checkout@v4	actions/checkout@11d5960a326750d5838078e36cf38b85af677262	tag

Dependabot

• Added a 7-day cooldown (cooldown: default-days: 7) to the existing github-actions Dependabot configuration.
• The cooldown delays applying a newly published action release for 7 days, reducing exposure to a compromised or broken release while keeping you SHA-pinned.

---

Generated by pinner 0.1.0.

[Copilot]

🟡 Changes recommended

The cooldown must also be added to the source template to prevent regeneration from removing it.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Pins GitHub Actions to immutable, verified commit SHAs and adds an update cooldown.

Changes:

• Pins seven action references to release SHAs.
• Adds a seven-day Dependabot cooldown.

File summaries

File	Description
.github/workflows/add-dependabot-pr-to-project.yml	Pins add-to-project.
.github/workflows/generate-dependabot.yml	Pins checkout.
.github/workflows/main.yml	Pins four checkout references.
.github/workflows/release.yml	Pins checkout.
.github/dependabot.yml	Adds the cooldown.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.