From 2521598634023c702d9885834e5fa1fc7f3d508d Mon Sep 17 00:00:00 2001
From: Alain Prasquier <alain@supervaize.com>
Date: Wed, 13 May 2026 15:52:37 +0300
Subject: [PATCH] chore(ci): SHA-pin actions/checkout and actions/setup-python
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pin all uses of actions/checkout@v6 and actions/setup-python@v6 to
their commit SHAs across every workflow, closing the remaining
floating-tag attack surface.

- actions/checkout  → de0fac2e (v6)
- actions/setup-python → a309ff8b (v6)
---
 .github/workflows/publish-pypi.yml         | 4 ++--
 .github/workflows/publish.yml              | 4 ++--
 .github/workflows/python-package.yml       | 8 ++++----
 .github/workflows/release.yml              | 2 +-
 .github/workflows/trufflehog-full-scan.yml | 2 +-
 .github/workflows/trufflehog-security.yml  | 2 +-
 6 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 4fcff7d..199b243 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -29,13 +29,13 @@ jobs:
       contents: write  # required for committing version bump
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.13"
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 96e78d3..3bc2e40 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -15,10 +15,10 @@ jobs:
       id-token: write # required for trusted publishing if using PyPI's OIDC
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.13"
 
diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml
index 1a78b28..ea2975e 100644
--- a/.github/workflows/python-package.yml
+++ b/.github/workflows/python-package.yml
@@ -14,8 +14,8 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.13"
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
@@ -43,9 +43,9 @@ jobs:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cc5c8ab..dc8b1e1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,7 +13,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0 # Required for generating release notes
 
diff --git a/.github/workflows/trufflehog-full-scan.yml b/.github/workflows/trufflehog-full-scan.yml
index 6037795..1cc69d8 100644
--- a/.github/workflows/trufflehog-full-scan.yml
+++ b/.github/workflows/trufflehog-full-scan.yml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0 # Full git history for complete scanning
 
diff --git a/.github/workflows/trufflehog-security.yml b/.github/workflows/trufflehog-security.yml
index 3954d46..e3840a9 100644
--- a/.github/workflows/trufflehog-security.yml
+++ b/.github/workflows/trufflehog-security.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0 # Required for TruffleHog to scan git history