From 830e4f7288635af9efe89e4f9c729b8ee8052ae1 Mon Sep 17 00:00:00 2001
From: Scott McKenzie <scott@noizyland.net>
Date: Sat, 17 Oct 2026 09:26:07 +1100
Subject: [PATCH] ci: pin GitHub Actions to commit SHAs

Pinned to the commits the v5 and v6 tags point to now, so CI runs the same
code. CLAUDE.md now requires SHA pins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NmFYyD2mPB84VpFUbdvbw6
---
 .github/workflows/ci.yml | 12 ++++++------
 CLAUDE.md                |  7 +++++++
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c946b3a..457ea9e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,8 +9,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: astral-sh/setup-uv@v6
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
       - run: uv sync --locked
       - run: uv run ruff check .
       - run: uv run ruff format --check .
@@ -23,8 +23,8 @@ jobs:
       matrix:
         python-version: ["3.10", "3.14"]
     steps:
-      - uses: actions/checkout@v5
-      - uses: astral-sh/setup-uv@v6
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
         with:
           python-version: ${{ matrix.python-version }}
       - run: uv sync --locked
@@ -33,6 +33,6 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: astral-sh/setup-uv@v6
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
       - run: uv build
diff --git a/CLAUDE.md b/CLAUDE.md
index 8f79008..f05c535 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -107,6 +107,13 @@ Always use `uv run` to execute Python code and tools. Never call `python`, `pyte
 - All CI/CD checks must pass
 - Minimum 1 approval required
 
+### GitHub Actions
+- Pin every action to a full commit SHA, with the release tag in a comment:
+  `uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1`. Never use a tag or branch
+  (`@v7`, `@main`), which can be moved to different code
+- Look up a release's SHA with `gh api repos/<owner>/<repo>/commits/<tag> --jq .sha`, and update the
+  SHA and the comment together
+
 ### Testing Requirements
 - Minimum 80% code coverage
 - All critical paths must have tests