From 33aebb380a0fd94596ddbceae6cc5c79cf52dc5e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 26 Oct 2026 16:59:35 +0000
Subject: [PATCH 1/2] Initial plan


From 0047389ba947d23587ae6565dd28de5ca4484963 Mon Sep 17 00:00:00 2001
From: Martin Hochel <hochelmartin@gmail.com>
Date: Mon, 26 Oct 2026 20:18:17 +0100
Subject: [PATCH 2/2] chore(ci): pin GitHub Actions to verified commit SHAs

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d59f2d05-2170-4b07-af4b-2e4c94f3608b
---
 .github/workflows/ci-change.yml |  4 ++--
 .github/workflows/ci.yml        | 12 ++++++------
 .github/workflows/docs.yml      | 10 +++++-----
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/ci-change.yml b/.github/workflows/ci-change.yml
index 1470ce3c..283a74a7 100644
--- a/.github/workflows/ci-change.yml
+++ b/.github/workflows/ci-change.yml
@@ -7,11 +7,11 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'pull_request' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: '^22.12.0'
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8fbb5625..400113b1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,14 +17,14 @@ jobs:
       actions: 'read'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
 
       - name: Derive appropriate SHAs for base and head for `nx affected` commands
         uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4.4.0
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           cache: 'yarn'
           node-version: '^22.12.0'
@@ -51,7 +51,7 @@ jobs:
       - run: yarn nx format:check --base origin/main
 
       - name: Upload Playwright artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         if: always() && steps.playwright-tests.outcome == 'failure'
         with:
           name: playwright-traces
@@ -76,7 +76,7 @@ jobs:
       actions: 'read'
     name: React ${{ matrix.react }} Integration
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
 
@@ -85,7 +85,7 @@ jobs:
         with:
           main-branch-name: 'master'
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           cache: 'yarn'
           node-version: '^22.12.0'
@@ -128,7 +128,7 @@ jobs:
 
       - name: Upload TSC logs
         if: always() && steps.type-check.outcome == 'failure'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: typescript-react-${{ matrix.react }}
           path: tsc-logs
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 29a944a1..78b0c888 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -30,11 +30,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           cache: 'yarn'
           node-version: '^22.12.0'
@@ -44,12 +44,12 @@ jobs:
       - run: yarn nx run-many --target=build-storybook,extract-storybook-llms
 
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           # Upload entire repository
           path: './dist/storybook'
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4