From 2e671755a11682717b2819400a1f9ad6a5d6c1a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=9Clgen=20Sar=C4=B1kavak?= <ulgensrkvk@gmail.com>
Date: Wed, 12 Aug 2026 00:27:23 +0300
Subject: [PATCH] Pin GHA dependencies

Relates to:
- https://github.com/processing/p5.js/issues/9033
- https://github.com/processing/p5.js/pull/9032
- https://github.com/processing/libprocessing/pull/226
---
 .github/workflows/issue_to_pr.yml              | 18 +++++++++---------
 .../pull_request_test_run_update_flow.yml      |  2 +-
 .github/workflows/update_contributions.yml     |  6 +++---
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/issue_to_pr.yml b/.github/workflows/issue_to_pr.yml
index 4f8e383..96022ae 100644
--- a/.github/workflows/issue_to_pr.yml
+++ b/.github/workflows/issue_to_pr.yml
@@ -23,12 +23,12 @@ jobs:
     steps:
       - name: Parse issue
         id: parseIssue
-        uses: onmax/issue-form-parser@v1.5
+        uses: onmax/issue-form-parser@7b55aeae4ae3c4f99df00f270991fe286e9ea826 # v1.5
         with:
           issue_number: ${{ github.event.issue.number }}
 
       - name: Checkout sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup Python
         uses: ./.github/actions/setup
@@ -46,7 +46,7 @@ jobs:
       - name: add comment to issue
         id: issueComment
         if: success()
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
         with:
           issue-number: ${{ github.event.issue.number }}
           body: |
@@ -54,7 +54,7 @@ jobs:
 
       - name: if failure, add comment to issue
         if: failure()
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
         with:
           issue-number: ${{ github.event.issue.number }}
           body: |
@@ -66,13 +66,13 @@ jobs:
 
       - name: check if target branch exists
         id: branchExists
-        uses: GuillaumeFalourd/branch-exists@v1
+        uses: GuillaumeFalourd/branch-exists@48261ee350426a6d9434c82c6033fea357a17592 # v1
         with:
           branch: ${{ env.BRANCH_NAME }}
 
       - name: delete target branch if exists
         if: steps.branchExists.outputs.exists == 'true'
-        uses: dawidd6/action-delete-branch@v3
+        uses: dawidd6/action-delete-branch@d1efac9a6f7a9b408d4e8ff663a99c1fbac17b3f # v3.1.0
         with:
           github_token: ${{github.token}}
           branches: ${{ env.BRANCH_NAME }}
@@ -88,7 +88,7 @@ jobs:
           python add_new_contribution_to_yaml.py '${{ steps.parseProps.outputs.props }}'
 
       - name: commit changes
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
         with:
           commit_message: adding contribution ${{ github.event.issue.title }} from #${{ github.event.issue.number }}
           branch: ${{ env.BRANCH_NAME }}
@@ -103,7 +103,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
 
       - name: add comment to issue
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
         with:
           comment-id:  ${{ steps.issueComment.outputs.comment-id }}
           body: |
@@ -112,7 +112,7 @@ jobs:
 
       - name: if failure, add comment to issue
         if: failure()
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
         with:
           comment-id:  ${{ steps.issueComment.outputs.comment-id }}
           body: |
diff --git a/.github/workflows/pull_request_test_run_update_flow.yml b/.github/workflows/pull_request_test_run_update_flow.yml
index 5b92e9e..c9a0aed 100644
--- a/.github/workflows/pull_request_test_run_update_flow.yml
+++ b/.github/workflows/pull_request_test_run_update_flow.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup Python
         uses: ./.github/actions/setup
diff --git a/.github/workflows/update_contributions.yml b/.github/workflows/update_contributions.yml
index fd21dab..83bd92a 100644
--- a/.github/workflows/update_contributions.yml
+++ b/.github/workflows/update_contributions.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup Python
         uses: ./.github/actions/setup
@@ -23,7 +23,7 @@ jobs:
           python fetch_updates.py 
 
       - name: commit changes
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
         with:
           commit_message: chore(CI) update contributions to database and output files
           branch: main
@@ -39,7 +39,7 @@ jobs:
           python to_contribs_txt.py
           python to_sources_jsons.py
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: output-files-${{ env.DATE }}
           overwrite: true