Update pinned actions

.github/actions/download-and-publish-test-coverage/action.yml

@@ -19,21 +19,21 @@ runs:
       continue-on-error: true
       id: download-artifact
       # We use this action and not Github's default, due to https://github.com/actions/download-artifact/issues/3
-      uses: dawidd6/action-download-artifact@e6e25ac3a2b93187502a8be1ef9e9603afc34925 # pin@v2.24.2
+      uses: dawidd6/action-download-artifact@e6e25ac3a2b93187502a8be1ef9e9603afc34925 # v2.24.2
       with:
         workflow: shopify-cli.yml
         workflow_conclusion: success
         branch: ${{ inputs.base-branch-name }}
         name: ${{ env.SAFE_BASE_REF_NAME }}--coverage-report
         if_no_artifact_found: ignore
-    - uses: ArtiomTr/jest-coverage-report-action@df2b025553c31d68f84be6337843e277e2576844 # pin@v2.2.1
+    - uses: ArtiomTr/jest-coverage-report-action@df2b025553c31d68f84be6337843e277e2576844 # v2.2.1
       id: coverage
       with:
         annotations: none
         output: report-markdown
         coverage-file: './report.json'
         base-coverage-file: './baseline-report.json'
         threshold: 0
-    - uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # pin@v2.3.1
+    - uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # v2.3.1
       with:
         message: ${{ steps.coverage.outputs.report }}

.github/actions/setup-cli-deps/action.yml

@@ -13,7 +13,7 @@ runs:
         git config --global user.name "App Management"
       shell: bash
     - name: Install pnpm
-      uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # pin@v4.0.0
+      uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0
       with:
         version: ${{ env.PNPM_VERSION }}
         run_install: false

.github/workflows/changelog-reminder.yml

@@ -10,7 +10,7 @@ jobs:
     if: ${{ github.event.pull_request.head.repo.full_name == github.repository && !github.event.pull_request.draft }}
     steps:
       - uses: actions/checkout@v3
-      - uses: mskelton/changelog-reminder-action@7039cd14fb784c0a2b37f6e7a6ade2c9148c2245 # pin@v2
+      - uses: mskelton/changelog-reminder-action@7039cd14fb784c0a2b37f6e7a6ade2c9148c2245 # v2
         with:
           changelogRegex: \.changeset
           message: |

.github/workflows/cla.yml

@@ -17,7 +17,7 @@ jobs:
       )
       || (github.event.pull_request && !github.event.pull_request.merged)
     steps:
-      - uses: Shopify/shopify-cla-action@9938f4b43524d1cfa7471ce9a803edf226697284 # pin@v1
+      - uses: Shopify/shopify-cla-action@9938f4b43524d1cfa7471ce9a803edf226697284 # v1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           cla-token: ${{ secrets.CLA_TOKEN }}

.github/workflows/codeql.yml

@@ -59,7 +59,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@dd746615b3b9d728a6a37ca2045b68ca76d4841a # pin@v3
+        uses: github/codeql-action/init@f47c8e6a9bd05ef3ee422fc8d8663be7fe4bdc61 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -87,6 +87,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@dd746615b3b9d728a6a37ca2045b68ca76d4841a # pin@v3
+        uses: github/codeql-action/analyze@f47c8e6a9bd05ef3ee422fc8d8663be7fe4bdc61 # v3
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/release.yml

@@ -59,7 +59,7 @@ jobs:
       - name: Force snapshot changeset
         run: "mv .changeset/force-snapshot-build.md.ignore .changeset/force-snapshot-build.md"
       - name: Create snapshot version
-        uses: Shopify/snapit@8dacdbe980a7628cf65d9b1d838ee7103450c6b8
+        uses: Shopify/snapit@8dacdbe980a7628cf65d9b1d838ee7103450c6b8 # 8dacdbe980a7628cf65d9b1d838ee7103450c6b8
         with:
           global_install: 'true'
           github_comment_included_packages: '@shopify/cli'
@@ -99,7 +99,7 @@ jobs:
         with:
           node-version: 24.12.0
       - name: Create Release Pull Request
-        uses: changesets/action@e9cc34b540dd3ad1b030c57fd97269e8f6ad905a #  pin@v1
+        uses: changesets/action@e0145edc7d9d8679003495b11f87bd8ef63c0cba # v1
         with:
           version: pnpm changeset-manifests
           title: Version Packages - ${{ github.ref_name }}

.github/workflows/tests-main.yml

@@ -66,7 +66,7 @@ jobs:
           SHOPIFY_CLI_PARTNERS_TOKEN: ${{ secrets.SHOPIFY_CLI_PARTNERS_TOKEN }}
         run: pnpm nx run features:test
       - name: Send Slack notification on failure
-        uses: slackapi/slack-github-action@007b2c3c751a190b6f0f040e47ed024deaa72844 # pin@v1.23.0
+        uses: slackapi/slack-github-action@007b2c3c751a190b6f0f040e47ed024deaa72844 # v1.23.0
         if: ${{ failure() && !cancelled() }}
         with:
           payload: |

.github/workflows/tests-manual.yml

@@ -66,6 +66,6 @@ jobs:
         run: pnpm test:features --output-style=stream
       - name: Setup tmate session
         if: ${{ failure() && inputs.debug-enabled }}
-        uses: mxschmitt/action-tmate@e5c7151931ca95bad1c6f4190c730ecf8c7dde48 # pin@v3
+        uses: mxschmitt/action-tmate@c0afd6f790e3a5564914980036ebf83216678101 # v3
         with:
           limit-access-to-actor: true

.github/workflows/tests-pr.yml

@@ -240,7 +240,7 @@ jobs:
         working-directory: workspace
         id: type-diff
         run: pnpm nx run type-diff
-      - uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # pin@v2.3.1
+      - uses: marocchino/sticky-pull-request-comment@fcf6fe9e4a0409cd9316a5011435be0f3327f1e1 # v2.3.1
         if: steps.type-diff.outputs.report != ''
         with:
           header: Type-diff

.github/workflows/workflow-cleaner.yml

@@ -48,7 +48,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Delete workflow runs
-        uses: Mattraks/delete-workflow-runs@4c9f24749b7996562658e3d6e10662489e22caca # pin@v2
+        uses: Mattraks/delete-workflow-runs@5bf9a1dac5c4d041c029f0a8370ddf0c5cb5aeb7 # v2
         with:
           token: ${{ github.token }}
           repository: ${{ github.repository }}

bin/pin-github-actions.js

@@ -17,7 +17,7 @@ if (args.length !== 3) {
     [
       `Usage: bin/${path.basename(__filename)} <GITHUB_ACCESS_TOKEN>\n`,
       'This script needs a Github access token to avoid hitting rate limits.',
-      'You can grab your existing one by running `dev github print-auth`.',
+      'You can grab your existing one by running `dev github print-auth --password`.',
     ].join('\n'),
   )
   process.exit(1)

bin/release

@@ -2,7 +2,7 @@
 
 tag=$1
 
-## If no tag is provided, default to latest
+## If no tag is provided, default to nightly
 if [ -z "$tag" ]; then
   tag="nightly"
 fi