From 4bfacf73ca8be664f00de645260bdc4fe7b30388 Mon Sep 17 00:00:00 2001
From: aznhassan <6496798+aznhassan@users.noreply.github.com>
Date: Wed, 28 Oct 2026 00:59:51 +0000
Subject: [PATCH] Pin workflow actions to commit SHAs

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/botsim.yml           | 6 +++---
 .github/workflows/makecode-release.yml | 4 ++--
 .github/workflows/makecode.yml         | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/botsim.yml b/.github/workflows/botsim.yml
index 7d42e1d..90475bf 100644
--- a/.github/workflows/botsim.yml
+++ b/.github/workflows/botsim.yml
@@ -19,9 +19,9 @@ jobs:
             actions: read
             contents: write                
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
             - name: Use Node.js ${{ matrix.node-version }}
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
               with:
                   node-version: ${{ matrix.node-version }}
             - run: npm ci
@@ -31,7 +31,7 @@ jobs:
             - run: npm run build
               working-directory: botsim
             - name: github pages
-              uses: peaceiris/actions-gh-pages@v3
+              uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3
               if: ${{ github.ref == 'refs/heads/main' }}
               with:
                   github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/makecode-release.yml b/.github/workflows/makecode-release.yml
index 427aa1b..d2082b8 100644
--- a/.github/workflows/makecode-release.yml
+++ b/.github/workflows/makecode-release.yml
@@ -10,13 +10,13 @@ jobs:
         actions: read
         contents: write    
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           submodules: recursive
       - run: npm install -g makecode
       - run: sh mkhex.sh
       - name: upload modified assets
-        uses: stefanzweifel/git-auto-commit-action@v4
+        uses: stefanzweifel/git-auto-commit-action@3ea6ae190baf489ba007f7c92608f33ce20ef04a # v4
         with:
             file_pattern: "assets/*"
             branch: main
diff --git a/.github/workflows/makecode.yml b/.github/workflows/makecode.yml
index 1280d5f..fa21b6a 100644
--- a/.github/workflows/makecode.yml
+++ b/.github/workflows/makecode.yml
@@ -12,7 +12,7 @@ jobs:
         actions: read
         contents: write    
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           submodules: recursive
       - run: npm install -g makecode