From f083af003a59a323fd70c464acde3ad010af2606 Mon Sep 17 00:00:00 2001
From: Phillip Mienk <mienkphi@gmail.com>
Date: Mon, 12 Oct 2026 14:32:03 -0700
Subject: [PATCH 1/2] Regenerate artifacts.

---
 .github/workflows/ci-expanded.yml | 46 +++++++++++++++++++----------
 .github/workflows/ci.yml          | 48 +++++++++++++++++++++----------
 .github/workflows/version-tag.yml |  4 +--
 3 files changed, 66 insertions(+), 32 deletions(-)

diff --git a/.github/workflows/ci-expanded.yml b/.github/workflows/ci-expanded.yml
index 2eb153f72..e7f85ade0 100644
--- a/.github/workflows/ci-expanded.yml
+++ b/.github/workflows/ci-expanded.yml
@@ -14,6 +14,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.repository_owner == 'libbitcoin' && (github.event.pull_request.number || github.run_id) || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   information:
     runs-on: ubuntu-latest
@@ -21,6 +24,9 @@ jobs:
     env:
       CONCURRENCY_GROUP: ${{ github.workflow }}-${{ github.repository_owner == 'libbitcoin' && (github.event.pull_request.number || github.run_id) || github.ref }}
 
+    permissions:
+      actions: write
+
     steps:
         - name: state
           run: |
@@ -33,6 +39,14 @@ jobs:
             echo "base_ref : ${{ github.base_ref }}"
             echo "head_ref : ${{ github.head_ref }}"
 
+        - name: cancel on pull_request closed
+          if: github.event_name == 'pull_request' && github.event.action == 'closed'
+          env:
+            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          run: |
+            gh api --method POST \
+              -H "Accept: application/vnd.github+json"   "/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel"
+
 
   gnu:
     if: github.event_name != 'pull_request' || github.event.action != 'closed'
@@ -355,7 +369,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -372,7 +386,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -441,7 +455,7 @@ jobs:
         shell: bash
         working-directory: 'libbitcoin-database'
         env:
-          COVERALLS_REPO_TOKEN: ${{ secrets.github_token }}
+          COVERALLS_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-linux-x86_64.tar.gz
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-checksums.txt
@@ -475,7 +489,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -803,7 +817,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -820,7 +834,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -889,7 +903,7 @@ jobs:
         shell: bash
         working-directory: 'libbitcoin-database'
         env:
-          COVERALLS_REPO_TOKEN: ${{ secrets.github_token }}
+          COVERALLS_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-linux-x86_64.tar.gz
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-checksums.txt
@@ -923,7 +937,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -1187,7 +1201,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -1204,7 +1218,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -1268,7 +1282,7 @@ jobs:
         shell: bash
         working-directory: 'libbitcoin-database'
         env:
-          COVERALLS_REPO_TOKEN: ${{ secrets.github_token }}
+          COVERALLS_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-linux-x86_64.tar.gz
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-checksums.txt
@@ -1302,7 +1316,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -1355,17 +1369,18 @@ jobs:
           fi
 
       - name: Set msbuild path
-        uses: microsoft/setup-msbuild@v3
+        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57
         with:
           msbuild-architecture: x64
 
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
+          persist-credentials: false
           ref: ${{ steps.get-branch.outputs.branch }}
           repository: ${{ github.repository_owner }}/libbitcoin-system
 
@@ -1378,10 +1393,11 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
+          persist-credentials: false
           repository: ${{ github.repository }}
 
       - name: Execute build
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 470f5dbe5..c7fd3a0fb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,6 +19,8 @@ on:
       - 'test/**'
       - 'tools/initchain/**'
   push:
+    tags-ignore:
+      - "**"
     paths:
       - 'builds/cmake/**'
       - 'builds/gnu/**'
@@ -33,6 +35,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.repository_owner == 'libbitcoin' && (github.event.pull_request.number || github.run_id) || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   information:
     runs-on: ubuntu-latest
@@ -40,6 +45,9 @@ jobs:
     env:
       CONCURRENCY_GROUP: ${{ github.workflow }}-${{ github.repository_owner == 'libbitcoin' && (github.event.pull_request.number || github.run_id) || github.ref }}
 
+    permissions:
+      actions: write
+
     steps:
         - name: state
           run: |
@@ -52,6 +60,14 @@ jobs:
             echo "base_ref : ${{ github.base_ref }}"
             echo "head_ref : ${{ github.head_ref }}"
 
+        - name: cancel on pull_request closed
+          if: github.event_name == 'pull_request' && github.event.action == 'closed'
+          env:
+            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          run: |
+            gh api --method POST \
+              -H "Accept: application/vnd.github+json"   "/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel"
+
 
   gnu:
     if: github.event_name != 'pull_request' || github.event.action != 'closed'
@@ -134,7 +150,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -151,7 +167,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -220,7 +236,7 @@ jobs:
         shell: bash
         working-directory: 'libbitcoin-database'
         env:
-          COVERALLS_REPO_TOKEN: ${{ secrets.github_token }}
+          COVERALLS_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-linux-x86_64.tar.gz
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-checksums.txt
@@ -254,7 +270,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -342,7 +358,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -359,7 +375,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -428,7 +444,7 @@ jobs:
         shell: bash
         working-directory: 'libbitcoin-database'
         env:
-          COVERALLS_REPO_TOKEN: ${{ secrets.github_token }}
+          COVERALLS_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-linux-x86_64.tar.gz
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-checksums.txt
@@ -462,7 +478,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -516,7 +532,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -533,7 +549,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -597,7 +613,7 @@ jobs:
         shell: bash
         working-directory: 'libbitcoin-database'
         env:
-          COVERALLS_REPO_TOKEN: ${{ secrets.github_token }}
+          COVERALLS_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-linux-x86_64.tar.gz
           curl -sLO https://github.com/coverallsapp/coverage-reporter/releases/latest/download/coveralls-checksums.txt
@@ -631,7 +647,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -672,17 +688,18 @@ jobs:
           fi
 
       - name: Set msbuild path
-        uses: microsoft/setup-msbuild@v3
+        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57
         with:
           msbuild-architecture: x64
 
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
+          persist-credentials: false
           ref: ${{ steps.get-branch.outputs.branch }}
           repository: ${{ github.repository_owner }}/libbitcoin-system
 
@@ -695,10 +712,11 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
+          persist-credentials: false
           repository: ${{ github.repository }}
 
       - name: Execute build
diff --git a/.github/workflows/version-tag.yml b/.github/workflows/version-tag.yml
index e51ae03e2..cbcda40fd 100644
--- a/.github/workflows/version-tag.yml
+++ b/.github/workflows/version-tag.yml
@@ -38,8 +38,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-        - name: Checkout
-          uses: actions/checkout@v6
+       - name: Checkout
+         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
           with:
             fetch-depth: 0
             ref: ${{ github.event.inputs.branch || 'master' }}

From 78618c979e5c8ea0e30ff67235dcda022ab8a2ba Mon Sep 17 00:00:00 2001
From: Phillip Mienk <mienkphi@gmail.com>
Date: Mon, 12 Oct 2026 14:49:00 -0700
Subject: [PATCH 2/2] Regenerate with comment.

---
 .github/workflows/ci-expanded.yml | 24 ++++++++++++------------
 .github/workflows/ci.yml          | 24 ++++++++++++------------
 .github/workflows/version-tag.yml |  2 +-
 3 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/ci-expanded.yml b/.github/workflows/ci-expanded.yml
index e7f85ade0..03638d894 100644
--- a/.github/workflows/ci-expanded.yml
+++ b/.github/workflows/ci-expanded.yml
@@ -369,7 +369,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -386,7 +386,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -489,7 +489,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -817,7 +817,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -834,7 +834,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -937,7 +937,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -1201,7 +1201,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -1218,7 +1218,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -1316,7 +1316,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -1369,14 +1369,14 @@ jobs:
           fi
 
       - name: Set msbuild path
-        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57
+        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3
         with:
           msbuild-architecture: x64
 
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -1393,7 +1393,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c7fd3a0fb..a9ab16c9b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -150,7 +150,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -167,7 +167,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -270,7 +270,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -358,7 +358,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -375,7 +375,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -478,7 +478,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -532,7 +532,7 @@ jobs:
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -549,7 +549,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
@@ -647,7 +647,7 @@ jobs:
 
       - name: Test artifact upload
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: testlogs
           path: ${{ github.workspace }}/*.errors
@@ -688,14 +688,14 @@ jobs:
           fi
 
       - name: Set msbuild path
-        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57
+        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3
         with:
           msbuild-architecture: x64
 
       - name: Checkout repository [libbitcoin-system]
         id: checkout-libbitcoin-system
         continue-on-error: true
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-system'
@@ -712,7 +712,7 @@ jobs:
 
       - name: Checkout repository [libbitcoin-database]
         id: checkout-libbitcoin-database
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           path: 'libbitcoin-database'
diff --git a/.github/workflows/version-tag.yml b/.github/workflows/version-tag.yml
index cbcda40fd..3fe51918b 100644
--- a/.github/workflows/version-tag.yml
+++ b/.github/workflows/version-tag.yml
@@ -39,7 +39,7 @@ jobs:
 
     steps:
        - name: Checkout
-         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
           with:
             fetch-depth: 0
             ref: ${{ github.event.inputs.branch || 'master' }}