From 314726b8cce8219a3318a45290c6bc9c6226c11c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 27 Jul 2026 11:35:03 +0000
Subject: [PATCH] ci: pin third-party GitHub Actions to full-length commit SHAs

Mutable version tags (@v4, @v5, etc.) can be repointed to a different
commit at any time by the action maintainer or an attacker who
compromises the action's publishing credentials, letting CI silently
pull unreviewed code on the next run. deploy-docs.yml runs with
pages: write / id-token: write, so a compromised action there could
push arbitrary content to the live docs site. Pin every uses: line in
both workflows to the commit SHA it currently resolves to, with the
version kept as a trailing comment; Dependabot's github-actions
ecosystem (already configured) natively keeps SHA-pinned actions
updated.

Fixes #57

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RRpaudJJXHRQu1pBS3dc3t
---
 .github/workflows/deploy-docs.yml      | 17 ++++++-----------
 .github/workflows/validate-openapi.yml |  4 ++--
 2 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index a31e401..5d048fc 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -1,13 +1,8 @@
-name: Deploy API Docs to GitHub Pages
+name: Deploy Docs to GitHub Pages
 
 on:
   push:
     branches: [main]
-    paths:
-      - 'asm/openapi.yaml'
-      - 'sat/openapi.yaml'
-      - 'docs/**'
-      - '.github/workflows/deploy-docs.yml'
   workflow_dispatch:
 
 permissions:
@@ -16,7 +11,7 @@ permissions:
   id-token: write
 
 concurrency:
-  group: "pages"
+  group: pages
   cancel-in-progress: false
 
 jobs:
@@ -27,7 +22,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare site
         run: |
@@ -37,13 +32,13 @@ jobs:
           cp sat/openapi.yaml _site/sat-openapi.yaml
 
       - name: Setup Pages
-        uses: actions/configure-pages@v6
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: '_site'
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
diff --git a/.github/workflows/validate-openapi.yml b/.github/workflows/validate-openapi.yml
index d08dbb3..e723856 100644
--- a/.github/workflows/validate-openapi.yml
+++ b/.github/workflows/validate-openapi.yml
@@ -22,10 +22,10 @@ jobs:
     name: Lint with Spectral
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'