pin sha

Author: wilson-cl

.github/workflows/generate-ea.yml

@@ -32,7 +32,7 @@ jobs:
     steps:
       - name: Check commenter permissions
         if: github.event_name == 'issue_comment'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({
@@ -48,29 +48,31 @@ jobs:
       - name: Get PR details (for comment trigger)
         if: github.event_name == 'issue_comment'
         id: pr
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const { data: pr } = await github.rest.pulls.get({
               owner: context.repo.owner,
               repo: context.repo.repo,
               pull_number: context.issue.number
             });
+            core.setOutput('head_sha', pr.head.sha);
             core.setOutput('head_ref', pr.head.ref);
             core.setOutput('number', pr.number);
 
       - name: Check out repository
-        uses: actions/[email protected]
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ github.event_name == 'issue_comment' && steps.pr.outputs.head_ref || github.head_ref }}
+          # Use SHA for immutable reference (prevents TOCTOU attacks)
+          ref: ${{ github.event_name == 'issue_comment' && steps.pr.outputs.head_sha || github.event.pull_request.head.sha }}
           fetch-depth: 0
           token: ${{ github.token }}
 
       - name: Install uv
         uses: astral-sh/setup-uv@e4db8464a088ece1b920f60402e813ea4de65b8f # v4
 
       - name: Set up Python
-        uses: actions/[email protected]
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
         with:
           python-version: "3.11"
 
@@ -107,7 +109,7 @@ jobs:
 
       - name: Get YAML file from PR
         id: yaml
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             // Determine PR number based on trigger type
@@ -160,7 +162,7 @@ jobs:
           uv sync
 
       - name: Install Node.js
-        uses: actions/[email protected]
+        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
         with:
           node-version: '22'
 
@@ -212,7 +214,7 @@ jobs:
           echo "✅ Changes committed and pushed"
 
       - name: Update PR description
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const jiraKey = '${{ steps.yaml.outputs.jira_key }}';