🛡️ Sentinel: Fix moving and non-existent version tags in GitHub Actions workflows by pinning to secure, immutable commit SHAs.

- Pin actions/checkout to immutable SHA of v4.4.0
- Pin jdx/mise-action to immutable SHA of v4.2.4
- Document the learning in the Sentinel security journal

Author: google-labs-jules[bot]

.github/workflows/check.yml

@@ -14,8 +14,8 @@ jobs:
           - "3.13"
           - "3.12"
     steps:
-      - uses: actions/checkout@v7
-      - uses: jdx/mise-action@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
         with:
           tool_versions: |
             python ${{ matrix.python-version }}

.github/workflows/docs.yml

@@ -10,8 +10,8 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: jdx/mise-action@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
       - name: Configure Git Credentials
         run: |
           git config user.name github-actions[bot]

.jules/sentinel.md

@@ -1,3 +1,8 @@
 # Sentinel Security Journal
 
 This journal contains critical security learnings specific to this project.
+
+## 2026-03-10 - Secure GitHub Actions Pinned to Immutable SHAs
+**Vulnerability:** Workflows were referencing a non-existent version tag `actions/checkout@v7` and a mutable major version tag `jdx/mise-action@v4`. Using non-existent or moving tags exposes the repository to supply chain and tag-spoofing attacks if an attacker registers or hijacks the version tag.
+**Learning:** Third-party actions should not rely on moving major version tags or non-existent tags. Moving tags are mutable, and their associated commits can change, potentially introducing untested or malicious code.
+**Prevention:** Pin all third-party GitHub Actions to secure, immutable 40-character full-length commit SHAs, and append a comment indicating the human-readable version (e.g. `# v4.4.0`). Dependabot can then be configured to automatically update these SHAs.