From 2e6f1b35b8c60e7138a9c0a1e53638af33a72a3b Mon Sep 17 00:00:00 2001
From: Joshua Li <joshuarli98@gmail.com>
Date: Mon, 23 Mar 2026 23:53:19 -0700
Subject: [PATCH] chore: pin GitHub Actions to full-length commit SHAs

---
 .github/workflows/CI.yml              | 18 +++++++++---------
 .github/workflows/prepare-publish.yml |  6 +++---
 .github/workflows/publish.yml         |  6 +++---
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index ed850bd..3a8ba98 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -10,8 +10,8 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           cache: yarn
           node-version-file: 'package.json'
@@ -22,7 +22,7 @@ jobs:
       - name: Build
         run: yarn build
       - name: Upload Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ${{ github.sha }}
           path: ./packages/**/dist/**/*
@@ -36,15 +36,15 @@ jobs:
       matrix:
         version: [18, 20, 22]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           cache: yarn
           node-version: ${{ matrix.version }}
       - name: Install
         run: yarn install
       - name: Download Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           path: ./packages
           merge-multiple: true
@@ -56,15 +56,15 @@ jobs:
     runs-on: macos-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           cache: yarn
           node-version-file: 'package.json'
       - name: Install
         run: yarn install
       - name: Download Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           path: ./packages
           merge-multiple: true
diff --git a/.github/workflows/prepare-publish.yml b/.github/workflows/prepare-publish.yml
index 45f6ef1..694f251 100644
--- a/.github/workflows/prepare-publish.yml
+++ b/.github/workflows/prepare-publish.yml
@@ -10,8 +10,8 @@ jobs:
     name: Prepare Publish
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           cache: yarn
           node-version-file: "package.json"
@@ -19,7 +19,7 @@ jobs:
         run: yarn install
       - name: Create Release Pull Request
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1
         with:
           version: yarn changeset:consume
           commit: "meta(changelog): Update package versions"
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b8234a7..04f2437 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -21,8 +21,8 @@ jobs:
       contains(github.event.head_commit.message, 'meta(changelog)') 
       && contains(github.event.head_commit.message, 'Update package versions')
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           cache: yarn
           node-version-file: "package.json"
@@ -31,7 +31,7 @@ jobs:
       - name: Build
         run: yarn build
       - name: Publish to NPM
-        uses: changesets/action@v1
+        uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}