[justinbanon-agent]

What this does

Pins 4 third-party action references in 4 files to the exact commit each tag points to today, with the version in a comment. This is option 2 from bosonprotocol/core-components#1046.

• No behaviour change: each SHA is the commit the tag or branch resolves to today, so the runs use the same code as now.
• Why: a tag such as @v4 can be moved by its publisher; a commit SHA cannot. That is what happened with tj-actions/changed-files in March 2025.
• Where the SHAs come from: the upstream repository's own tags (annotated tags resolved to the commit, not the tag object).

Pinned

File	Line	Was	Now	Version
.github/workflows/deploy-preview.yaml	43	marocchino/sticky-pull-request-comment@v2	marocchino/sticky-pull-request-comment@7737449	v2.9.4
.github/workflows/deploy_reusable.yaml	289	cloudflare/wrangler-action@v3	cloudflare/wrangler-action@9acf94a	v3.15.0
.github/workflows/jekyll-gh-pages.yml	34	ruby/setup-ruby@v1	ruby/setup-ruby@824c0e2	v1.331.0
.github/workflows/lint-pr.yaml	15	amannn/action-semantic-pull-request@v4	amannn/action-semantic-pull-request@505e44b	v4.6.0

One reference moved upstream since 19 Oct; pinned to what it resolves to today.

Full SHAs are in the diff.

• marocchino/sticky-pull-request-comment: v2 is a branch; its head is the commit of release tag v2.9.4.
• ruby/setup-ruby: v1 is a branch; its head is the commit of release tag v1.331.0.

Left as they are

• .github/workflows/deploy_reusable.yaml line 267, getsentry/action-release@v1: It runs the container image ghcr.io/getsentry/action-release-image:1.11.0 by tag, so pinning the action does not freeze what runs (rule R5). Your plan replaces it with a plain npx @sentry/cli@<version> step; that needs a sentry-cli version and the release, commit-association and deploy calls the action makes, which is a choice for you rather than a mechanical swap. Left as it is.
• .github/actions/setup-node-pnpm/action.yml line 10, pnpm/action-setup@v4: allowed by name in the organisation list; your rule R1 says no pin.
• For your R5 check: cloudflare/wrangler-action and ruby/setup-ruby install a tool at run time (your "check carefully" list in Cheap alternative to #1045: pin third-party actions by SHA and allow those exact SHAs at org level core-components#1046). Pinning freezes the action, not what it installs.

How to check

On this pull request, these workflows start (no "workflow file issue") and pass:

• Lint PR: the title check.
• Deploy PR preview: the sticky preview comment and the Cloudflare deploy (wrangler).

In each job's "Set up job" log, the "Download action repository" lines show the pinned SHAs.

After the merge to main:

• Deploy to testing on main: wrangler, and the Sentry release step (unchanged).
• Deploy Jekyll with GitHub Pages dependencies preinstalled on main: the Ruby set-up.

Once this is green, the organisation's "any version" entries for these actions can be swapped for the exact SHAs, but only for an action that no other repo still uses by tag.

Rollback: revert this merge.

Prepared by Claude for Justin; Ludo reviews and merges. Refs bosonprotocol/core-components#1046.

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

Preview deployment

View	URL
dApp	https://13773be1.interface-a9d.pages.dev/#/dapp
DR Center	https://13773be1.interface-a9d.pages.dev/#/dr_center

Built from 0f97596.