Pin GitHub Actions to commit SHAs

[github-security-bot]

Pins GitHub Actions uses: references in github/paste-markdown to immutable commit SHAs.

Summary

Metric	Count
Files changed	3
Files scanned	2
Refs found	7
Refs pinned	7
Skipped refs	0
Warnings	0
Errors	0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

• Original refs are preserved in inline comments when possible.
• Pin comments use the Dependabot-compatible original-ref style.
• Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
• No minimum action age was enforced for this run.

Pinned refs

Location	Before	After	Resolved as
.github/workflows/nodejs.yml:13	actions/checkout@v2	actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e	tag
.github/workflows/nodejs.yml:15	actions/setup-node@v1	actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e	tag
.github/workflows/publish.yml:15	actions/checkout@v3	actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26	tag
.github/workflows/publish.yml:16	actions/setup-node@v3	actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610	tag
.github/workflows/publish.yml:33	actions/checkout@v3	actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26	tag
.github/workflows/publish.yml:34	actions/setup-node@v3	actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610	tag
.github/workflows/publish.yml:42	actions/setup-node@v3	actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610	tag

Dependabot

• Added .github/dependabot.yml enabling weekly github-actions updates with a 7-day cooldown (cooldown: default-days: 7).
• The cooldown delays applying a newly published action release for 7 days, reducing exposure to a compromised or broken release while keeping you SHA-pinned.

---

Generated by pinner 0.1.0.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.