From c596e9687aaf32a7a6df5b231ac5a643006e7624 Mon Sep 17 00:00:00 2001
From: Brian G <brian.goslin@consensys.net>
Date: Mon, 11 May 2026 15:53:36 +0100
Subject: [PATCH] chore: pin GitHub Actions to commit SHAs

Pin every `uses:` ref in .github/workflows and composite actions to a
full 40-character commit SHA, with the original tag preserved as a
comment, e.g.

    uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

Tags and branches are mutable; commit SHAs are not. Pinning to a SHA
closes a supply-chain vector where a compromised action could replace
what runs in CI without changing the tag we reference.

Generated mechanically with `pinact run`
(https://github.com/suzuki-shunsuke/pinact). No version bumps were
applied (strict pin).
---
 .github/workflows/build.yml | 2 +-
 .github/workflows/case.yml  | 2 +-
 .github/workflows/links.yml | 2 +-
 .github/workflows/lint.yml  | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 757caf51..ef86f6bb 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -13,7 +13,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Build
         uses: ConsenSys/docs-gha/build@main
diff --git a/.github/workflows/case.yml b/.github/workflows/case.yml
index c1b9eefc..e6b5aa64 100644
--- a/.github/workflows/case.yml
+++ b/.github/workflows/case.yml
@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Case check action
         uses: ConsenSys/docs-gha/case@main
diff --git a/.github/workflows/links.yml b/.github/workflows/links.yml
index be794e16..e9b9eff2 100644
--- a/.github/workflows/links.yml
+++ b/.github/workflows/links.yml
@@ -15,7 +15,7 @@ jobs:
       matrix:
         file-extensions: [".md", ".mdx"]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: LinkCheck
         uses: ConsenSys/docs-gha/linkcheck@main
         with:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index ee02efae..4c238847 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -13,7 +13,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Lint
         uses: ConsenSys/docs-gha/lint@main