valkyrjaio / valkyrja-starter-app-ts / 30415860223

100%

push

github

[CI] Pin GitHub Actions to commit SHAs in the CI workflow (#83)

# Description

Every third-party GitHub Action referenced by this application's
`ci.yml` was pinned to a mutable tag
(`@v6`, `@v2`, …). A mutable ref means the action's owner — or anyone
who
compromises their account — can change the code that runs in our CI
without any
change landing in this repository.

This is part of an organization-wide sweep. It replicates what
`valkyrjaio/valkyrja-app-php` did for its own `ci.yml` and what

[valkyrjaio/.github#148](https://github.com/valkyrjaio/.github/pull/148)
does for
the shared reusable workflows: pin every third-party action to a full
40-character commit SHA, with the resolved release tag kept in a
trailing comment
so the version stays readable and upgrades stay reviewable.

The change is purely mechanical — every changed line is a `uses:` line,
and the
SHAs match those used by the sibling repositories in the same sweep, so
the whole
organization agrees on one pinned version per action.

**Verification.** All workflow YAML files still parse, the diff contains
no
non-`uses:` edits, and trailing newlines are intact.

## Types of changes

- [x] Improvement _(non-breaking change which improves code)_
- [ ] Bug fix _(non-breaking change which fixes an issue)_
- [ ] New feature _(non-breaking change which adds functionality)_
- [ ] Deprecation _(breaking change which removes functionality)_
- [ ] Breaking change _(fix or feature that would cause existing
functionality to change)_
- [ ] Documentation improvement

## Changes

- **`ci.yml`** — pinned all third-party actions to commit SHAs:
- **`actions/checkout`** — pinned to
`d23441a48` (`v6.1.0`)
- **`actions/setup-node`** — pinned to
`49933ea52` (`v4.4.0`)

9 of 9 branches covered (100.0%)

Branch coverage included in aggregate %.

72 of 72 relevant lines covered (100.0%)

2.38 hits per line