From 0f975963b68a920b04586216336e645a1cd6e4ef Mon Sep 17 00:00:00 2001
From: justinbanon-agent <justinbanon-agent@users.noreply.github.com>
Date: Wed, 21 Oct 2026 19:45:37 +0100
Subject: [PATCH] ci: pin third-party actions to exact commit SHAs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/deploy-preview.yaml  | 2 +-
 .github/workflows/deploy_reusable.yaml | 2 +-
 .github/workflows/jekyll-gh-pages.yml  | 2 +-
 .github/workflows/lint-pr.yaml         | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/deploy-preview.yaml b/.github/workflows/deploy-preview.yaml
index e95bca06a..a014f863b 100644
--- a/.github/workflows/deploy-preview.yaml
+++ b/.github/workflows/deploy-preview.yaml
@@ -40,7 +40,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Comment preview URL
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
         with:
           header: cf-preview
           message: |
diff --git a/.github/workflows/deploy_reusable.yaml b/.github/workflows/deploy_reusable.yaml
index 51dd97059..5c225cf6c 100644
--- a/.github/workflows/deploy_reusable.yaml
+++ b/.github/workflows/deploy_reusable.yaml
@@ -286,7 +286,7 @@ jobs:
 
       - name: Deploy to Cloudflare Pages
         id: deploy
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
diff --git a/.github/workflows/jekyll-gh-pages.yml b/.github/workflows/jekyll-gh-pages.yml
index f8ac85f56..97bc2e21c 100644
--- a/.github/workflows/jekyll-gh-pages.yml
+++ b/.github/workflows/jekyll-gh-pages.yml
@@ -31,7 +31,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.ref }}
           fetch-depth: 0
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@824c0e29fdfc7d689c191c27acc969d2d04b7dd8 # v1.331.0
         with:
           ruby-version: '3.3' # Not needed with a .ruby-version file
           bundler-cache: true # runs 'bundle install' and caches installed gems automatically
diff --git a/.github/workflows/lint-pr.yaml b/.github/workflows/lint-pr.yaml
index 0e5b69056..54acaa3d3 100644
--- a/.github/workflows/lint-pr.yaml
+++ b/.github/workflows/lint-pr.yaml
@@ -12,7 +12,7 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-22.04
     steps:
-      - uses: amannn/action-semantic-pull-request@v4
+      - uses: amannn/action-semantic-pull-request@505e44b4f33b4c801f063838b3f053990ee46ea7 # v4.6.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: