From 2a841eaa3cb68e04d399c39286fc02611116feb1 Mon Sep 17 00:00:00 2001
From: mahmoud karzoun <135722882+mkarson1997@users.noreply.github.com>
Date: Wed, 9 Sep 2026 13:16:01 +0300
Subject: [PATCH 1/2] security: pin CI actions to immutable SHAs

---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 850dbb0..a8af7f9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,10 +33,10 @@ jobs:
       FLOWFORGE_TEST_DATABASE_URL: postgresql://flowforge@127.0.0.1:5432/flowforge_test
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ matrix.node-version }}
 

From 8e612f682f40012e336085aa2c58ffdff22a3724 Mon Sep 17 00:00:00 2001
From: mahmoud karzoun <135722882+mkarson1997@users.noreply.github.com>
Date: Wed, 9 Sep 2026 13:16:12 +0300
Subject: [PATCH 2/2] security: pin CodeQL workflow actions to immutable SHAs

---
 .github/workflows/codeql.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e34a0aa..fe21e3f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,12 +19,12 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           languages: javascript-typescript
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4