John KennedyandGitHub bcf3077267 ci: SHA-pin all third-party GitHub Actions (#7277) ...

## Summary

- SHA-pins 7 distinct third-party actions across 10 workflow files to
full commit SHAs
- Prevents supply chain attacks via tag hijacking (mutable tags can be
force-pushed by a compromised maintainer account)
- Tag retained as an inline comment for readability

| Action | Before | After |
|--------|--------|-------|
| `dorny/paths-filter` | `@v4` | `@fbd0ab8...` |
| `Ana06/get-changed-files` | `@v2.3.0` | `@25f79e6...` |
| `docker/login-action` | `@v4` | `@b45d80f...` |
| `pypa/gh-action-pypi-publish` | `@release/v1` | `@ed0c539...` |
| `ncipollo/release-action` | `@v1` | `@339a818...` |
| `amannn/action-semantic-pull-request` | `@v6` | `@48f2562...` |
| `peter-evans/create-pull-request` | `@v8` | `@c0f553f...` |

## Test plan

- [x] CI passes on this PR
- [x] Verify each pinned action still functions (no behaviour change,
only ref format)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

2026-03-25 10:58:38 -07:00

..

actions/uv_setup

chore: extract reusable uv_setup composite action (#7262)

2026-03-24 00:25:58 -04:00

images

chore: new logos (#7002)

2026-03-02 11:59:44 -05:00

ISSUE_TEMPLATE

chore: extract reusable uv_setup composite action (#7262)

2026-03-24 00:25:58 -04:00

scripts

feat(cli): add keep_latest prune strategy to ThreadTTLConfig (#6784)

2026-02-11 19:00:48 -08:00

workflows

ci: SHA-pin all third-party GitHub Actions (#7277)

2026-03-25 10:58:38 -07:00

dependabot.yml

chore: conformance testing (#6842)

2026-02-17 09:49:22 -08:00

PULL_REQUEST_TEMPLATE.md

chore: update templates (#7261)

2026-03-24 00:17:49 -04:00