[levalleux-ludo]

What this does

Pins 2 third-party action references in 2 files to the exact commit each tag points to today, with the version in a comment. This is option 2 from bosonprotocol/core-components#1046.

• No behaviour change: each SHA is the commit the tag or branch resolves to today, so the runs use the same code as now.
• Why: a tag such as @v4 can be moved by its publisher; a commit SHA cannot. That is what happened with tj-actions/changed-files in March 2025.
• Where the SHAs come from: the upstream repository's own tags (annotated tags resolved to the commit, not the tag object).

Pinned

File	Line	Was	Now	Version
.github/workflows/lint-pr.yaml	15	amannn/action-semantic-pull-request@v4	amannn/action-semantic-pull-request@505e44b	v4.6.0
.github/workflows/publish.yaml	70	cycjimmy/semantic-release-action@v4	cycjimmy/semantic-release-action@16ca923	v4.2.2

Full SHAs are in the diff.

• cycjimmy/semantic-release-action: v4 is a branch; its head is the commit of release tag v4.2.2.

Left as they are

Nothing: every third-party reference in this repo is now pinned.

• For your R5 check: cycjimmy/semantic-release-action installs a tool at run time (your "check carefully" list in #1046). Pinning freezes the action, not what it installs.

How to check

On this pull request, these workflows start (no "workflow file issue") and pass:

• Lint PR: the title check.

In each job's "Set up job" log, the "Download action repository" lines show the pinned SHAs.

After the merge to main:

• Publish - Chat SDK runs on main (the semantic-release step).

Once this is green, the organisation's "any version" entries for these actions can be swapped for the exact SHAs, but only for an action that no other repo still uses by tag.

Rollback: revert this merge.

Prepared by Claude for Justin; Ludo reviews and merges. Refs #1046.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

Both pinned SHAs were verified to exactly match the upstream v4.6.0 and v4.2.2 tags, the change is behavior-preserving, and the pinning format follows standard convention.

No open issues 🎉

What changed in this PR

This PR hardens the repository's CI supply chain by pinning the two genuinely third-party GitHub Actions to the exact commit SHAs that their version tags currently resolve to, keeping the human-readable version in a trailing comment. This is the "option 2" mitigation from issue #1046, protecting against the risk of a publisher moving a tag (as happened with tj-actions/changed-files in March 2025). The pinned SHAs resolve to the same commits as the current tags, so there is no behavior change.

Changes:

• Pin amannn/action-semantic-pull-request@v4 → @505e44b… (v4.6.0) in the PR-title lint workflow.
• Pin cycjimmy/semantic-release-action@v4 → @16ca923… (v4.2.2) in the publish workflow.

File	Description
.github/​workflows/​lint-pr.yaml	Pins the semantic-PR-title action to its v4.6.0 commit SHA with a version comment.
.github/​workflows/​publish.yaml	Pins the semantic-release action to its v4.2.2 commit SHA with a version comment.

_{Review effort: Balanced}