From d322a37e3638c91b40beb004e762acd9a3b7ca27 Mon Sep 17 00:00:00 2001
From: Brian G <brian.goslin@consensys.net>
Date: Fri, 18 Sep 2026 16:38:58 +0100
Subject: [PATCH] chore: pin GitHub Actions to commit SHAs

Pin every `uses:` ref in .github/workflows and composite actions to a
full 40-character commit SHA, with the original tag preserved as a
comment, e.g.

    uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

Tags and branches are mutable; commit SHAs are not. Pinning to a SHA
closes a supply-chain vector where a compromised action could replace
what runs in CI without changing the tag we reference.

Generated mechanically with `pinact run`
(https://github.com/suzuki-shunsuke/pinact). No version bumps were
applied (strict pin).
---
 .github/workflows/build-lint-test.yml   | 12 ++++++------
 .github/workflows/create-release-pr.yml |  4 ++--
 .github/workflows/main.yml              |  4 ++--
 .github/workflows/publish-release.yml   |  8 ++++----
 4 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/build-lint-test.yml b/.github/workflows/build-lint-test.yml
index 5a3bc89..ee4a891 100644
--- a/.github/workflows/build-lint-test.yml
+++ b/.github/workflows/build-lint-test.yml
@@ -26,9 +26,9 @@ jobs:
       matrix:
         node-version: [8.x, 10.x, 12.x, 14.x, 16.x, 18.x, 20.x]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
@@ -52,9 +52,9 @@ jobs:
       matrix:
         node-version: [12.x]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
@@ -70,9 +70,9 @@ jobs:
       matrix:
         node-version: [8.x, 10.x, 12.x, 14.x, 16.x, 18.x, 20.x]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
diff --git a/.github/workflows/create-release-pr.yml b/.github/workflows/create-release-pr.yml
index 75e6309..ab781d5 100644
--- a/.github/workflows/create-release-pr.yml
+++ b/.github/workflows/create-release-pr.yml
@@ -21,7 +21,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
         with:
           # This is to guarantee that the most recent tag is fetched.
           # This can be configured to a more reasonable value by consumers.
@@ -30,7 +30,7 @@ jobs:
           # branch for all git operations and the release PR.
           ref: ${{ github.event.inputs.base-branch }}
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version-file: '.nvmrc'
       - uses: MetaMask/action-create-release-pr@2d124c5b0bf1fb10111589cd95b6b22734ac66d3
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index c9423c2..41a54b0 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -10,7 +10,7 @@ jobs:
     name: Check workflows
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
       - name: Download actionlint
         id: download-actionlint
         run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/7fdc9630cc360ea1a469eed64ac6d78caeda1234/scripts/download-actionlint.bash) 1.6.22
@@ -61,7 +61,7 @@ jobs:
       IS_RELEASE: ${{ steps.is-release.outputs.IS_RELEASE }}
     runs-on: ubuntu-latest
     steps:
-      - uses: MetaMask/action-is-release@v1
+      - uses: MetaMask/action-is-release@ae1ebc864afddef847279b999952c7b8fbe21005 # v1.1.0
         id: is-release
 
   publish-release:
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index b3290c7..f660c66 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -13,11 +13,11 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
         with:
           ref: ${{ github.sha }}
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version-file: '.nvmrc'
       - uses: MetaMask/action-publish-release@bc0d19824e88e009af68413d7fd01278f79436b8
@@ -29,11 +29,11 @@ jobs:
           npm run build
       - name: Dry Run Publish
         # omit npm-token token to perform dry run publish
-        uses: MetaMask/action-npm-publish@v1.1.0
+        uses: MetaMask/action-npm-publish@e2ad37bb13f17223eca8738b15a58cba3036f194 # v1.1.0
         env:
           SKIP_PREPACK: true
       - name: Publish
-        uses: MetaMask/action-npm-publish@v1.1.0
+        uses: MetaMask/action-npm-publish@e2ad37bb13f17223eca8738b15a58cba3036f194 # v1.1.0
         with:
           # This `NPM_TOKEN` needs to be manually set per-repository.
           # Look in the repository settings under "Environments", and set this token in the `npm-publish` environment.