From 5c25c83397dd9e0c8799f545db3ba4609c655256 Mon Sep 17 00:00:00 2001 From: Kaiyi Li Date: Mon, 27 Apr 2026 11:27:59 -0700 Subject: [PATCH 1/2] pin github actions to SHAs --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/snapit.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3ff758e3..d21b2fa3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,7 +20,7 @@ jobs: uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Install pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 with: version: 10 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5ec26750..7e488a60 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,7 +22,7 @@ jobs: token: ${{ secrets.SHOPIFY_GH_ACCESS_TOKEN }} - name: Install pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 with: version: 10 diff --git a/.github/workflows/snapit.yml b/.github/workflows/snapit.yml index b950b12b..9e248bf6 100644 --- a/.github/workflows/snapit.yml +++ b/.github/workflows/snapit.yml @@ -16,7 +16,7 @@ jobs: uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Install pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 with: version: 10 From fb51180e2e1a2e898a0b871466d57c14bb90cd30 Mon Sep 17 00:00:00 2001 From: Kaiyi Li Date: Mon, 27 Apr 2026 13:01:43 -0700 Subject: [PATCH 2/2] Use precise semver tags in pin comments --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/snapit.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d21b2fa3..83dac3a6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,7 +20,7 @@ jobs: uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Install pnpm - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 with: version: 10 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7e488a60..1494c712 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,7 +22,7 @@ jobs: token: ${{ secrets.SHOPIFY_GH_ACCESS_TOKEN }} - name: Install pnpm - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 with: version: 10 diff --git a/.github/workflows/snapit.yml b/.github/workflows/snapit.yml index 9e248bf6..e66db81e 100644 --- a/.github/workflows/snapit.yml +++ b/.github/workflows/snapit.yml @@ -16,7 +16,7 @@ jobs: uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Install pnpm - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 with: version: 10