Pin GitHub Actions to commit SHAs

[github-security-bot]

Pins GitHub Actions uses: references in github/octoforce-actions to immutable commit SHAs.

Summary

Metric	Count
Files changed	6
Files scanned	5
Refs found	11
Refs pinned	11
Skipped refs	0
Warnings	0
Errors	0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

• Original refs are preserved in inline comments when possible.
• Pin comments use the Dependabot-compatible original-ref style.
• Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
• No minimum action age was enforced for this run.

Pinned refs

Location	Before	After	Resolved as
.github/workflows/issue-branch-creation-handler.yml:15	actions/checkout@v2.5.0	actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791	tag
.github/workflows/issue-branch-creation-handler.yml:19	actions/setup-node@v6	actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38	tag
.github/workflows/issue-branch-creation-handler.yml:23	actions/cache@v5	actions/cache@caa296126883cff596d87d8935842f9db880ef25	tag
.github/workflows/pr-validate-deploy.yml:67	actions/setup-node@v6	actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38	tag
.github/workflows/pr-validate-deploy.yml:72	actions/cache@v5	actions/cache@caa296126883cff596d87d8935842f9db880ef25	tag
.github/workflows/push-to-main-handler.yml:48	actions/setup-node@v6	actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38	tag
.github/workflows/push-to-main-handler.yml:54	actions/cache@v5	actions/cache@caa296126883cff596d87d8935842f9db880ef25	tag
.github/workflows/release-branch-merge-handler.yml:19	actions/checkout@v2.5.0	actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791	tag
.github/workflows/release-branch-pull-request-handler.yml:59	actions/checkout@v2.5.0	actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791	tag
.github/workflows/release-branch-pull-request-handler.yml:65	actions/setup-node@v6	actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38	tag
.github/workflows/release-branch-pull-request-handler.yml:69	actions/cache@v5	actions/cache@caa296126883cff596d87d8935842f9db880ef25	tag

Dependabot

• Added .github/dependabot.yml enabling weekly github-actions updates with a 7-day cooldown (cooldown: default-days: 7).
• The cooldown delays applying a newly published action release for 7 days, reducing exposure to a compromised or broken release while keeping you SHA-pinned.

---

Generated by pinner 0.1.0.

[Copilot]

🟢 Approval recommended

All changed references resolve to the documented tags, and the Dependabot configuration is valid.

Pull request overview

Pins external GitHub Actions to immutable SHAs and configures Dependabot to keep them updated.

Changes:

• Pins 11 action references while retaining version comments.
• Adds weekly Dependabot updates with a seven-day cooldown.

File summaries

File	Description
.github/dependabot.yml	Configures action updates.
.github/workflows/issue-branch-creation-handler.yml	Pins three actions.
.github/workflows/pr-validate-deploy.yml	Pins two actions.
.github/workflows/push-to-main-handler.yml	Pins two actions.
.github/workflows/release-branch-merge-handler.yml	Pins checkout.
.github/workflows/release-branch-pull-request-handler.yml	Pins three actions.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[rdietrick]

@dependabot rebase