From 38e45f2a1eee9aea6a036589a7a94be996054255 Mon Sep 17 00:00:00 2001
From: Jack Whitton <185863790+jackw-phantom@users.noreply.github.com>
Date: Wed, 5 Aug 2026 16:57:25 +0000
Subject: [PATCH] ci: pin release workflow actions to commit SHAs (FEPLAT-5069)

Mutable refs (actions/checkout@v3, actions/setup-node@v3,
changesets/action@v1) let a moved tag or compromised upstream change CI
code that publishes to npm without a change in this repo. Pin each to
the 40-character commit its current ref resolves to, with the version
in a trailing comment.

No version change: the pinned SHAs are exactly what the mutable refs
resolve to today.

Co-authored-by: casper-phantom[bot] <208212958+casper-phantom[bot]@users.noreply.github.com>
---
 .github/workflows/release.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index df113ce2..77609e37 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,13 +17,13 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Enable Corepack
         run: corepack enable
 
       - name: Setup Node.js 20.x
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: 20.x
 
@@ -32,7 +32,7 @@ jobs:
 
       - name: Create Release Pull Request or Publish to npm
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
         with:
           # This expects you to have a script called release which does a build for your packages and calls changeset publish
           version: yarn changeset version