chore: pin GitHub Actions to commit SHAs

[slawomirbabicz]

Pin GitHub Actions to commit SHAs

GitHub Actions referenced by tag (e.g. actions/checkout@v4) use a mutable pointer — the tag owner can move it to a different commit at any time, including a malicious one. This is the attack vector used in the tj-actions/changed-files incident (CVE-2025-30066).

Pinning to a full 40-character commit SHA makes the reference immutable. The # tag comment preserves human readability so reviewers can tell which version is pinned.

Important: a SHA can also originate from a forked repository. A malicious actor can fork an action, push a compromised commit to the fork, and the SHA will resolve — but it won't exist in the upstream canonical repo. Each SHA in this PR was verified against the action's canonical repository (not a fork).

Changes

• actions/checkout@v4 -> actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

  • Version: v4.3.1 | Latest: v6.0.2 | Release age: 90d
  • Commit: actions/checkout@34e1148

• actions/setup-node@v4 -> actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0

  • Version: v4.4.0 | Latest: v6.3.0 | Release age: 37d
  • Commit: actions/setup-node@49933ea

• cachix/install-nix-action@v22 -> cachix/install-nix-action@6ed004b9ccb68dbc28e7c85bee15fa93dbd214ac # v22

  • Version: v22 | Latest: v31.10.4 | Release age: 396d
  • Commit: cachix/install-nix-action@6ed004b
  • Warnings: Latest release v31.10.4 is only 1 day(s) old (< 7 days). Using previous safe release.

• JamesIves/github-pages-deploy-action@v4 -> JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0

  • Version: v4.8.0 | Latest: v4.8.0 | Release age: 90d
  • Commit: JamesIves/github-pages-deploy-action@d92aa23

• ZenVoich/setup-mops@v1 -> ZenVoich/setup-mops@3e94e453352269b34137b5ce49f09a8df81bed7d # v1.4.1

  • Version: v1.4.1 | Latest: v1.4.1 | Release age: 569d
  • Commit: caffeinelabs/setup-mops@3e94e45

• devmasx/merge-branch@v1.3.1 -> devmasx/merge-branch@a1752b9ba42bb417ec19be7dc974e2faf77d3ef2 # v1.3.1

  • Version: v1.3.1 | Latest: 1.4.0 | Release age: 1684d
  • Commit: devmasx/merge-branch@a1752b9

Files modified

• .github/workflows/ci.yml
• .github/workflows/mops-publish.yml
• .github/workflows/package-set.yml
• .github/workflows/prettier.yml
• .github/workflows/sync.yml

Security warnings

• Latest release v31.10.4 is only 1 day(s) old (< 7 days). Using previous safe release.