Pin GitHub Actions to commit SHAs

[github-security-bot]

Pins GitHub Actions uses: references in github/explore to immutable commit SHAs.

Summary

Metric	Count
Files changed	7
Files scanned	6
Refs found	13
Refs pinned	13
Skipped refs	0
Warnings	0
Errors	0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

• Original refs are preserved in inline comments when possible.
• Pin comments use the Dependabot-compatible original-ref style.
• Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
• No minimum action age was enforced for this run.

Pinned refs

Location	Before	After	Resolved as
.github/workflows/collections-renames.yml:19	actions/checkout@v7.0.1	actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1	tag
.github/workflows/collections-renames.yml:34	peter-evans/create-pull-request@v8	peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1	tag
.github/workflows/explore-triage-commenter.yml:27	actions/github-script@v9	actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3	tag
.github/workflows/explore-triage-commenter.yml:206	actions/upload-artifact@v7	actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	tag
.github/workflows/jekyll_build.yml:24	actions/checkout@v7.0.1	actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1	tag
.github/workflows/jekyll_build.yml:34	actions/configure-pages@v6.0.0	actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d	tag
.github/workflows/jekyll_build.yml:40	actions/upload-pages-artifact@v5.0.0	actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9	tag
.github/workflows/jekyll_build.yml:56	actions/deploy-pages@v5.0.0	actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128	tag
.github/workflows/lint.yml:16	actions/checkout@v7.0.1	actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1	tag
.github/workflows/lint.yml:36	actions/checkout@v7.0.1	actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1	tag
.github/workflows/stale.yml:17	actions/stale@v11.0.0	actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93	tag
.github/workflows/test.yml:36	actions/checkout@v7.0.1	actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1	tag
.github/workflows/test.yml:65	actions/cache@v6	actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9	tag

Dependabot

• Added a 7-day cooldown (cooldown: default-days: 7) to the existing github-actions Dependabot configuration.
• The cooldown delays applying a newly published action release for 7 days, reducing exposure to a compromised or broken release while keeping you SHA-pinned.

---

Generated by pinner 0.1.0.

[Copilot]

🟢 Approval recommended

All action SHAs match their documented version tags, and the Dependabot configuration is valid.

Pull request overview

Pins GitHub Actions to immutable SHAs and adds a seven-day Dependabot cooldown.

Changes:

• Pins 13 action references with version comments.
• Adds a seven-day action-update cooldown.

File summaries

File	Description
.github/workflows/collections-renames.yml	Pins checkout and PR creation actions.
.github/workflows/explore-triage-commenter.yml	Pins script and artifact actions.
.github/workflows/jekyll_build.yml	Pins Pages workflow actions.
.github/workflows/lint.yml	Pins checkout references.
.github/workflows/stale.yml	Pins the stale action.
.github/workflows/test.yml	Pins checkout and cache actions.
.github/dependabot.yml	Adds the update cooldown.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.