From af567b78996e71c968227d77d6f87f95878ce5a3 Mon Sep 17 00:00:00 2001 From: Ryan Buchmayer Date: Wed, 22 Jul 2026 21:39:58 -0700 Subject: [PATCH] ci: pin actions to full commit SHAs The org now requires all actions to be pinned to a full-length commit SHA; every workflow (test, publish, publish-mcp, validate-plugin) has been failing at setup since June with "actions must be pinned to a full-length commit SHA". Pin actions/checkout@v6 and actions/setup-node@v6 to their tag commits. --- .github/workflows/publish-mcp.yml | 2 +- .github/workflows/publish.yml | 4 ++-- .github/workflows/test.yml | 4 ++-- .github/workflows/validate-plugin.yml | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/publish-mcp.yml b/.github/workflows/publish-mcp.yml index 0ecdec4..fc6bea8 100644 --- a/.github/workflows/publish-mcp.yml +++ b/.github/workflows/publish-mcp.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Install MCP Publisher run: | diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 6656fd7..eaa1ac6 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -17,10 +17,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: node-version: '20' registry-url: 'https://registry.npmjs.org' diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index e3466db..7012be0 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -11,10 +11,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: node-version: '20' diff --git a/.github/workflows/validate-plugin.yml b/.github/workflows/validate-plugin.yml index 10733b5..fb0f5b9 100644 --- a/.github/workflows/validate-plugin.yml +++ b/.github/workflows/validate-plugin.yml @@ -17,10 +17,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Setup Node.js - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: node-version: '20'