From 1bc45f126bdc135dede2eaaade1e3efc63a37b9e Mon Sep 17 00:00:00 2001
From: Sage Hart <sagehart@MacBookAir.attlocal.net>
Date: Sat, 11 Jul 2026 19:41:13 -0500
Subject: [PATCH] chore(security): pin GitHub Actions and tighten workflow
 permissions

Pin third-party actions to immutable SHAs and add default read-only
permissions to close OpenSSF Scorecard PinnedDependencies and
TokenPermissions alerts.
---
 .github/workflows/ci.yml     | 6 +++---
 .github/workflows/codeql.yml | 3 +--
 .github/workflows/deploy.yml | 3 +--
 .github/workflows/docker.yml | 3 +--
 4 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c53e552..b2b3f15 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,8 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 20
           cache: npm
@@ -33,7 +33,7 @@ jobs:
       matrix:
         node-version: [20, 22, 24]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4ca3883..a335398 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -27,8 +27,7 @@ jobs:
       matrix:
         language: [javascript-typescript]
     steps:
-      - uses: actions/checkout@v7
-
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3
         with:
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index b8784c5..6fe50b9 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -16,8 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Abort if Fly token not configured
         if: ${{ secrets.FLY_API_TOKEN == '' }}
         run: |
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index e62091f..56f968d 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -27,8 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v7
-
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4