From 4231e8fc7ad0cedd7dec8fc452b95ffebbab125c Mon Sep 17 00:00:00 2001
From: timlichtenberg <lichtenberg.tim@gmail.com>
Date: Thu, 22 Oct 2026 17:12:54 +0200
Subject: [PATCH] Pin GitHub Actions to commit SHAs and test the oldest Node

Each action now points to a full commit SHA with its release tag in a comment, so a moved tag cannot change what runs; Dependabot updates the SHA and the comment together. The pull request build now runs on Node 22.23.4, the oldest version package.json allows, as well as on Node 24.
---
 .github/workflows/deploy.yml   |  8 ++++----
 .github/workflows/pr-build.yml | 11 ++++++++---
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 44ccefe..e3d3c1a 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -21,14 +21,14 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 24
           cache: npm
       - run: npm ci
       - run: npm run build
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
         with:
           path: ./dist
 
@@ -40,4 +40,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
index e9441bc..eb08b21 100644
--- a/.github/workflows/pr-build.yml
+++ b/.github/workflows/pr-build.yml
@@ -10,13 +10,18 @@ jobs:
   build:
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        # The oldest Node that package.json engines allows, and the Node the deploy uses.
+        node: ['22.23.4', '24']
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 24
+          node-version: ${{ matrix.node }}
           cache: npm
       - run: npm ci
       - run: npm run build