From 96f9820250c3fc1f0c3e6bebb612d5fc19c4cbce Mon Sep 17 00:00:00 2001
From: "open-swe[bot]" <open-swe@users.noreply.github.com>
Date: Wed, 22 Jul 2026 21:27:50 +0100
Subject: [PATCH] chore(ci): pin action refs to verified SHAs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rewrites mutable version tags to 40-char SHAs with a trailing version
comment. A tag can be silently repointed by its owner; a SHA cannot.

Every SHA was resolved THROUGH the tag object and re-verified against the
commits endpoint before being written — not copied by hand. An annotated
tag's ref sha is the tag OBJECT, not the commit, and getting that wrong is
how df-cicd ended up with four pins to commits that never existed,
silently killing infra-dns's IaC gate for six consecutive runs
(df-cicd#18). Any ref that could not be confirmed was left untouched.

Branch refs (@main/@master) are deliberately NOT rewritten: choosing which
release to adopt is a decision, not a mechanical substitution.

Against the org baseline this takes the repo from 15 advisory finding(s)
to 2 — fully clean, with 0 required.

Generated by df-cicd/baseline/pin_actions.py.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PRVqMsvZcbfRnV6KUTMF2Q
---
 .github/workflows/ci.yml            | 12 ++++++------
 .github/workflows/release.yml       | 10 +++++-----
 .github/workflows/sync-upstream.yml |  4 ++--
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dad3ecd..bb17dcd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,10 +21,10 @@ jobs:
       matrix:
         python: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3
         with:
           enable-cache: true
           cache-dependency-glob: "pyproject.toml"
@@ -56,10 +56,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3
         with:
           enable-cache: true
           cache-dependency-glob: "pyproject.toml"
@@ -77,7 +77,7 @@ jobs:
       - name: List artifacts
         run: ls -la dist/
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: dist
           path: dist/
@@ -93,7 +93,7 @@ jobs:
       # fetch-depth: 0 so gitleaks scans every commit on the branch, not just
       # the tip — secrets that were briefly committed and then removed still
       # live in history and remain harvestable.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f89a706..ed8633d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3
         with:
           enable-cache: true
           cache-dependency-glob: "pyproject.toml"
@@ -77,7 +77,7 @@ jobs:
       - name: Validate distribution metadata
         run: uv tool run twine check dist/*
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: dist
           path: dist/
@@ -97,7 +97,7 @@ jobs:
     permissions:
       id-token: write  # OIDC for trusted publishing
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: dist
           path: dist/
@@ -119,7 +119,7 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: dist
           path: dist/
diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml
index d8f580c..14b3a92 100644
--- a/.github/workflows/sync-upstream.yml
+++ b/.github/workflows/sync-upstream.yml
@@ -19,10 +19,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3
 
       - name: Set up Python 3.13
         run: uv python install 3.13