From 3f6e111f5df9973a85dafa913bc36fb3d821ee18 Mon Sep 17 00:00:00 2001 From: Gavin Hofer Date: Wed, 13 May 2026 11:41:22 -0400 Subject: [PATCH] chore(actions): pin all github action digests Per SDLC Governance Basics for SOC 2 Compliance, all GitHub actions should be pinned to their digest SHA to prevent supply chain attacks that exploit mutable version tags. Co-Authored-By: Claude Opus 4.7 --- .github/workflows/build.yml | 4 ++-- .github/workflows/test.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 447d7c9..4ffccbd 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -11,8 +11,8 @@ jobs: name: Run Typescript Build runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions/setup-node@v1 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 + - uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6 with: node-version: 16 - name: Install Dependencies diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 3b717ce..bbc506c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -11,8 +11,8 @@ jobs: name: Run Tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions/setup-node@v1 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 + - uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6 with: node-version: 16 - name: Install Dependencies