[claude]

Requested by Sebastian Konowrocki · Slack thread

Before: .github/workflows/ci.yaml referenced actions/checkout@v3 and actions/setup-node@v3 by floating major-version tag. Tag refs are mutable: whoever controls the upstream repo (or an attacker who compromises it, as in the recent "shai-hulud" style supply-chain worms) can move a tag to point at malicious code, which CI would then execute with repository credentials.

After: Both actions are pinned to the immutable full commit SHA of their current v5 release, with a trailing comment naming the version so the intent stays readable:

• actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
• actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0

Following review feedback, the same SHA pinning is now also applied to release.yaml, which previously pinned these actions by the floating @v5 tag:

• actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
• actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5

A SHA cannot be repointed, so the exact action code that runs is fixed and auditable.

How: Edits the uses: lines in .github/workflows/ci.yaml and .github/workflows/release.yaml. SHAs were resolved from the upstream actions/checkout and actions/setup-node repositories (the commit each v5 tag points to — verified that @v5 resolves to the same tree as v5.0.1/v5.0.0 respectively).

---

Generated by Claude Code

[Komoszek]

Also pin actions in the other flow

[claude]

Done — pinned the actions in release.yaml too (the only other workflow; ci.yaml was already pinned).

.github/workflows/release.yaml:

• actions/checkout@v5 → actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
• actions/setup-node@v5 → actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5

These are the same SHAs used in ci.yaml; I verified @v5 resolves to the same commit tree as v5.0.1 (checkout) and v5.0.0 (setup-node). Pushed as 7bc85fb.