From 74319b58b916fec5ec49fd84773ce25ef88e7249 Mon Sep 17 00:00:00 2001 From: Jaixii Date: Mon, 10 Aug 2026 02:41:07 -0400 Subject: [PATCH] fix(ci): SHA-pin actions/checkout in cowork-auto-pr workflow The cowork-auto-pr.yml workflow used unpinned actions/checkout@v4 while all other workflows (ci.yml, publish.yml, release-audit.yml) use SHA-pinned versions. This creates supply-chain risk and inconsistency. Pinned to d23441a48e516b6c34aea4fa41551a30e30af803 (v6) to match the fleet standard. --- .github/workflows/cowork-auto-pr.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cowork-auto-pr.yml b/.github/workflows/cowork-auto-pr.yml index b27f04e..3a455a8 100644 --- a/.github/workflows/cowork-auto-pr.yml +++ b/.github/workflows/cowork-auto-pr.yml @@ -16,7 +16,7 @@ jobs: # without this step every run failed with "not a git repository" and no # PR was ever opened (fleet-wide defect: 11/11 seeded copies lacked it). - name: Check out the pushed branch - uses: actions/checkout@v4 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: ref: ${{ github.ref_name }} fetch-depth: 0