From e8f0bf92a51909631d7dc6b298ad9f32087374e4 Mon Sep 17 00:00:00 2001
From: babarot <b4b4r07@gmail.com>
Date: Fri, 17 Apr 2026 17:33:02 +0900
Subject: [PATCH] chore: pin third-party actions to SHA and harden workflows

---
 .ghalint.yaml                      | 6 ++++++
 .github/workflows/add_labels.yaml  | 6 ++++--
 .github/workflows/release.yaml     | 4 ++--
 .github/workflows/sync_labels.yaml | 6 ++++--
 4 files changed, 16 insertions(+), 6 deletions(-)
 create mode 100644 .ghalint.yaml

diff --git a/.ghalint.yaml b/.ghalint.yaml
new file mode 100644
index 0000000..9358a0c
--- /dev/null
+++ b/.ghalint.yaml
@@ -0,0 +1,6 @@
+excludes:
+  # tagpr needs git credentials to push tags and create releases
+  - policy_name: checkout_persist_credentials_should_be_false
+    workflow_file_path: .github/workflows/release.yaml
+    job_name: tagpr
+    step_name: Checkout
diff --git a/.github/workflows/add_labels.yaml b/.github/workflows/add_labels.yaml
index 7bb8f37..fb4751f 100644
--- a/.github/workflows/add_labels.yaml
+++ b/.github/workflows/add_labels.yaml
@@ -11,8 +11,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
-      - uses: actions/labeler@v5
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
         with:
           sync-labels: true
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index fc74b31..8a3fd20 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -17,9 +17,9 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Run tagpr
-        uses: Songmu/tagpr@3dca11e7c0d68637ee212ddd35acc3d30a7403a4 # v1.5.0
+        uses: Songmu/tagpr@9d0f650553240dab1fa907eca27e3fd5b586e538 # v1.18.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         id: run-tagpr
diff --git a/.github/workflows/sync_labels.yaml b/.github/workflows/sync_labels.yaml
index 0a10e9f..2b7041c 100644
--- a/.github/workflows/sync_labels.yaml
+++ b/.github/workflows/sync_labels.yaml
@@ -18,9 +18,11 @@ jobs:
     timeout-minutes: 2
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Sync labels
-        uses: EndBug/label-sync@v2
+        uses: EndBug/label-sync@52074158190acb45f3077f9099fea818aa43f97a # v2.3.3
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           config-file: .github/labels.yaml