Pin GitHub Actions to commit SHAs

[github-security-bot]

Pins GitHub Actions uses: references in github/emergency-pull-request-probot-app to immutable commit SHAs.

Summary

Metric	Count
Files changed	3
Files scanned	3
Refs found	5
Refs pinned	5
Skipped refs	0
Warnings	1
Errors	0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

• Original refs are preserved in inline comments when possible.
• Pin comments use the Dependabot-compatible original-ref style.
• Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
• No minimum action age was enforced for this run.

Pinned refs

Location	Before	After	Resolved as
.github/workflows/docker-build-publish.yml:18	actions/checkout@v7	actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1	tag
.github/workflows/pr.yml:21	actions/checkout@v7	actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1	tag
.github/workflows/pr.yml:22	actions/setup-node@v7	actions/setup-node@820762786026740c76f36085b0efc47a31fe5020	tag
.github/workflows/test.yml:15	actions/checkout@v7	actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1	tag
.github/workflows/test.yml:16	actions/setup-node@v7	actions/setup-node@820762786026740c76f36085b0efc47a31fe5020	tag

Warnings

Location	Ref	Reason
.github/dependabot.yml	``	.github/dependabot.yml left unchanged: github-actions ecosystem present in an unrecognized or complex form

---

Generated by pinner 0.1.0.

[Copilot]

🟢 Approval recommended

All workflow references are immutable, and the pinned SHAs match the documented release tags.

Pull request overview

Pins GitHub Actions dependencies to immutable SHAs to prevent tag retargeting.

Changes:

• Pins five checkout and setup-node references.
• Preserves version tags in inline comments.

File summaries

File	Description
.github/workflows/test.yml	Pins test workflow actions.
.github/workflows/pr.yml	Pins PR workflow actions.
.github/workflows/docker-build-publish.yml	Pins checkout for image publishing.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

=============================== Coverage summary ===============================
Statements   : 100% ( 166/166 )
Branches     : 100% ( 102/102 )
Functions    : 100% ( 28/28 )
Lines        : 100% ( 164/164 )
================================================================================