ci: pin every action to a commit SHA, with the config that keeps them fresh (audit P1)

.github/dependabot.yml

@@ -0,0 +1,27 @@
+# Pinning every action to a commit SHA closes the supply-chain hole that a
+# mutable tag leaves open: `@v4` is a pointer its owner can move, and whatever
+# it points at runs inside CI with whatever that job can reach.
+#
+# But a pin with nothing to move it is its own defect. It trades "an action can
+# change under us" for "an action can never be patched", and the second failure
+# is silent — no alert fires for a security release we simply never took. So
+# the pin and this file ship together; neither is complete alone.
+#
+# The `# v4` comment beside each SHA is not decoration. Dependabot reads it to
+# know which tag the pin tracks, and rewrites both the SHA and the comment when
+# that tag moves. Delete the comment and the pin stops being updated.
+#
+# Scope is deliberately github-actions only. Adding npm and pip here would open
+# a large number of pull requests across three repositories at once, which is a
+# separate decision about review capacity rather than about supply chain.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "ci"
+    labels:
+      - dependencies
+      - github-actions

.github/workflows/ci.yml

@@ -20,12 +20,12 @@ jobs:
     name: version bumped when published files change
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           # Need history back to the merge base to compare versions.
           fetch-depth: 0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
 
@@ -41,9 +41,9 @@ jobs:
       run:
         working-directory: node
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
           cache: npm
@@ -74,8 +74,8 @@ jobs:
       run:
         working-directory: wallet
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
           cache: npm
@@ -100,9 +100,9 @@ jobs:
       run:
         working-directory: mcp
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
           cache: npm
@@ -143,8 +143,8 @@ jobs:
     name: mcp — built against the agent in this commit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
 
@@ -172,9 +172,9 @@ jobs:
       run:
         working-directory: python
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.13'
           cache: pip
@@ -190,9 +190,9 @@ jobs:
     name: examples — syntax gate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20