From 7f86598751a1c28b33c321bf6a50f755f929735d Mon Sep 17 00:00:00 2001
From: Jeff Repanich <jrepanich@gmail.com>
Date: Thu, 20 Aug 2026 09:30:44 -0400
Subject: [PATCH] ci: use readable action versions

---
 .github/workflows/bench.yml   |  7 +++----
 .github/workflows/ci.yml      |  5 ++---
 .github/workflows/publish.yml | 14 ++++++--------
 .github/workflows/quality.yml | 30 ++++++++++++++++++------------
 4 files changed, 29 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index 55fd29ec..6967baab 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -16,14 +16,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        uses: actions/setup-node@v7
         with:
           node-version: 'lts/*'
           cache: 'npm'
-
       - name: Install dependencies
         run: npm ci
 
@@ -81,7 +80,7 @@ jobs:
         run: npm run bench:tier4 -- --outputJson bench-results/tier4-run3.json
 
       - name: Upload benchmark artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@v7
         with:
           name: bench-results-stable
           path: bench-results/
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c11a34b3..926bf85d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,14 +24,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        uses: actions/setup-node@v7
         with:
           node-version: 'lts/*'
           cache: npm
-
       - name: Install dependencies
         run: npm ci
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d150bf2e..0e413ac4 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -13,27 +13,26 @@ jobs:
     name: Publish
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    environment: npm
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        uses: actions/setup-node@v7
         with:
           node-version: 'lts/*'
           cache: npm
-
       - name: Compute release tag
         id: version
-        uses: askrjs/actions/actions/compute-release-tag@cfbfac63066d778fa1fa99247f6af43515155e4f
+        uses: askrjs/actions/actions/compute-release-tag@main
 
       - name: Check whether tag exists
         id: tag_status
-        uses: askrjs/actions/actions/check-tag-exists@cfbfac63066d778fa1fa99247f6af43515155e4f
+        uses: askrjs/actions/actions/check-tag-exists@main
         with:
           tag: ${{ steps.version.outputs.tag }}
-
       - name: Verify an existing tag points to this verified commit
         if: steps.tag_status.outputs.exists == 'true'
         shell: bash
@@ -53,10 +52,9 @@ jobs:
 
       - name: Create release tag
         if: steps.tag_status.outputs.exists != 'true'
-        uses: askrjs/actions/actions/create-tag@cfbfac63066d778fa1fa99247f6af43515155e4f
+        uses: askrjs/actions/actions/create-tag@main
         with:
           tag: ${{ steps.version.outputs.tag }}
-
       - name: Checkout release tag
         if: steps.tag_status.outputs.exists != 'true'
         shell: bash
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 3be93ae8..faabf0ef 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -15,14 +15,16 @@ jobs:
     timeout-minutes: 20
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - name: Checkout repository
+        uses: actions/checkout@v7
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+      - name: Setup Node
+        uses: actions/setup-node@v7
         with:
           node-version: 'lts/*'
           cache: npm
-
-      - run: npm ci
+      - name: Install dependencies
+        run: npm ci
 
       - name: Run replayable lifecycle sequences
         env:
@@ -31,7 +33,7 @@ jobs:
 
       - name: Upload failing seed traces
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@v7
         with:
           name: quality-seed-traces
           path: .askr-quality-traces/
@@ -53,19 +55,23 @@ jobs:
           - os: macos-latest
             browser: webkit
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - name: Checkout repository
+        uses: actions/checkout@v7
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+      - name: Setup Node
+        uses: actions/setup-node@v7
         with:
           node-version: 'lts/*'
           cache: npm
+      - name: Install dependencies
+        run: npm ci
 
-      - run: npm ci
-
-      - run: npx playwright install --with-deps ${{ matrix.browser }}
+      - name: Install browser with system dependencies
+        run: npx playwright install --with-deps ${{ matrix.browser }}
         if: runner.os == 'Linux'
 
-      - run: npx playwright install ${{ matrix.browser }}
+      - name: Install browser
+        run: npx playwright install ${{ matrix.browser }}
         if: runner.os != 'Linux'
 
       - name: Run browser coverage
@@ -75,7 +81,7 @@ jobs:
 
       - name: Upload browser diagnostics
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@v7
         with:
           name: quality-browser-${{ matrix.os }}-${{ matrix.browser }}
           path: |