[justinbanon-agent]

What this does

Pins 4 third-party action references in 4 files to the exact commit each tag points to today, with the version in a comment. This is option 2 from bosonprotocol/core-components#1046.

• No behaviour change: each SHA is the commit the tag or branch resolves to today, so the runs use the same code as now.
• Why: a tag such as @v4 can be moved by its publisher; a commit SHA cannot. That is what happened with tj-actions/changed-files in March 2025.
• Where the SHAs come from: the upstream repository's own tags (annotated tags resolved to the commit, not the tag object).

Pinned

File	Line	Was	Now	Version
.github/workflows/deploy-preview.yaml	43	marocchino/sticky-pull-request-comment@v2	marocchino/sticky-pull-request-comment@7737449	v2.9.4
.github/workflows/deploy_reusable.yaml	289	cloudflare/wrangler-action@v3	cloudflare/wrangler-action@9acf94a	v3.15.0
.github/workflows/jekyll-gh-pages.yml	34	ruby/setup-ruby@v1	ruby/setup-ruby@824c0e2	v1.331.0
.github/workflows/lint-pr.yaml	15	amannn/action-semantic-pull-request@v4	amannn/action-semantic-pull-request@505e44b	v4.6.0

One reference moved upstream since 19 Oct; pinned to what it resolves to today.

Full SHAs are in the diff.

• marocchino/sticky-pull-request-comment: v2 is a branch; its head is the commit of release tag v2.9.4.
• ruby/setup-ruby: v1 is a branch; its head is the commit of release tag v1.331.0.

Left as they are

• .github/workflows/deploy_reusable.yaml line 267, getsentry/action-release@v1: It runs the container image ghcr.io/getsentry/action-release-image:1.11.0 by tag, so pinning the action does not freeze what runs (rule R5). Your plan replaces it with a plain npx @sentry/cli@<version> step; that needs a sentry-cli version and the release, commit-association and deploy calls the action makes, which is a choice for you rather than a mechanical swap. Left as it is.
• .github/actions/setup-node-pnpm/action.yml line 10, pnpm/action-setup@v4: allowed by name in the organisation list; your rule R1 says no pin.
• For your R5 check: cloudflare/wrangler-action and ruby/setup-ruby install a tool at run time (your "check carefully" list in Cheap alternative to #1045: pin third-party actions by SHA and allow those exact SHAs at org level core-components#1046). Pinning freezes the action, not what it installs.

How to check

On this pull request, these workflows start (no "workflow file issue") and pass:

• Lint PR: the title check.
• Deploy PR preview: the sticky preview comment and the Cloudflare deploy (wrangler).

In each job's "Set up job" log, the "Download action repository" lines show the pinned SHAs.

After the merge to main:

• Deploy to testing on main: wrangler, and the Sentry release step (unchanged).
• Deploy Jekyll with GitHub Pages dependencies preinstalled on main: the Ruby set-up.

Once this is green, the organisation's "any version" entries for these actions can be swapped for the exact SHAs, but only for an action that no other repo still uses by tag.

Rollback: revert this merge.

Prepared by Claude for Justin; Ludo reviews and merges. Refs bosonprotocol/core-components#1046.

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

Preview deployment

View	URL
dApp	https://13773be1.interface-a9d.pages.dev/#/dapp
DR Center	https://13773be1.interface-a9d.pages.dev/#/dr_center

Built from 0f97596.

[Copilot]

🟢 Approval recommended

All four pinned SHAs were verified via the GitHub API to resolve exactly to their stated version tags, each action is referenced only once, and the change introduces no behavioral difference.

No open issues 🎉

What changed in this PR

This PR hardens the CI supply chain by pinning four third-party GitHub Actions from movable Git tags/branches (@v4, @v3, @v1, @v2) to the exact commit SHAs those references currently resolve to, keeping the human-readable version in a trailing comment. This mitigates the risk of an upstream publisher moving a tag to point at malicious code (as happened with tj-actions/changed-files in March 2025), while preserving current runtime behavior. It implements "option 2" from bosonprotocol/core-components#1046.

I verified each pinned SHA against the upstream repositories via the GitHub API, and all four correctly resolve to the stated version tags (e.g., 505e44b… → amannn/action-semantic-pull-request v4.6.0, 824c0e2… → ruby/setup-ruby v1.331.0, 773744… → marocchino/sticky-pull-request-comment v2.9.4, 9acf94a… → cloudflare/wrangler-action v3.15.0). Each action is used only once in the repo, and the actions deliberately left unpinned are clearly documented.

Changes:

• Pin amannn/action-semantic-pull-request, ruby/setup-ruby, marocchino/sticky-pull-request-comment, and cloudflare/wrangler-action to exact commit SHAs with version comments.
• No behavioral change: each SHA matches the commit its former tag currently resolves to.

File	Description
.github/​workflows/​lint-pr.yaml	Pins amannn/action-semantic-pull-request to 505e44b… (v4.6.0).
.github/​workflows/​jekyll-gh-pages.yml	Pins ruby/setup-ruby to 824c0e2… (v1.331.0).
.github/​workflows/​deploy-preview.yaml	Pins marocchino/sticky-pull-request-comment to 773744… (v2.9.4).
.github/​workflows/​deploy_reusable.yaml	Pins cloudflare/wrangler-action to 9acf94a… (v3.15.0).

_{Review effort: Balanced}