From 6c430a9f783e3deb6784f0f3ab4ea25102d6f6d8 Mon Sep 17 00:00:00 2001 From: Will Pfleger Date: Wed, 3 Jun 2026 15:43:48 -0400 Subject: [PATCH] fix(ci): pin action SHAs with correct version comments zizmor flagged the checkout SHA comment as `# v6` when it's actually pinned to v6.0.2. Also pin create-github-app-token to its commit SHA instead of the rolling `@v3` tag. --- .github/workflows/sync-release-changelog.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/sync-release-changelog.yml b/.github/workflows/sync-release-changelog.yml index ed19e20a8f..188d2c04bc 100644 --- a/.github/workflows/sync-release-changelog.yml +++ b/.github/workflows/sync-release-changelog.yml @@ -64,14 +64,14 @@ jobs: - name: Generate GitHub App token if: steps.find-pr.outputs.found == 'true' id: app-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: client-id: ${{ vars.RELEASE_APP_CLIENT_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} - name: Check out release PR branch if: steps.find-pr.outputs.found == 'true' - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ steps.find-pr.outputs.branch }} fetch-depth: 0