Pin GitHub Actions to commit SHAs

[github-security-bot]

Pins GitHub Actions uses: references in github/git-sizer to immutable commit SHAs.

Summary

Metric	Count
Files changed	4
Files scanned	3
Refs found	6
Refs pinned	6
Skipped refs	0
Warnings	0
Errors	0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

• Original refs are preserved in inline comments when possible.
• Pin comments use the Dependabot-compatible original-ref style.
• Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
• No minimum action age was enforced for this run.

Pinned refs

Location	Before	After	Resolved as
.github/workflows/lint.yml:24	actions/setup-go@v2	actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492	tag
.github/workflows/lint.yml:29	actions/checkout@v2	actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e	tag
.github/workflows/release.yml:24	actions/checkout@v4	actions/checkout@11d5960a326750d5838078e36cf38b85af677262	tag
.github/workflows/release.yml:31	softprops/action-gh-release@v1	softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844	tag
.github/workflows/test.yml:15	actions/setup-go@v6	actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16	tag
.github/workflows/test.yml:20	actions/checkout@v2	actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e	tag

Dependabot

• Added .github/dependabot.yml enabling weekly github-actions updates with a 7-day cooldown (cooldown: default-days: 7).
• The cooldown delays applying a newly published action release for 7 days, reducing exposure to a compromised or broken release while keeping you SHA-pinned.

---

Generated by pinner 0.1.0.

[Copilot]

🟡 Changes recommended

The release workflow retains an unpinned mutable action reference.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Pins GitHub Actions dependencies to immutable SHAs and configures automated weekly updates.

Changes:

• Pins six action references to commit SHAs.
• Adds a seven-day Dependabot cooldown.
• One multiline actions/setup-go@v4 reference remains unpinned.

File summaries

File	Description
.github/workflows/test.yml	Pins test actions.
.github/workflows/release.yml	Pins two release actions.
.github/workflows/lint.yml	Pins lint actions.
.github/dependabot.yml	Enables weekly action updates.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.