Pin GitHub Actions to commit SHAs

[github-security-bot]

Pins GitHub Actions uses: references in github/accessibility-scanner-alt-text-plugin to immutable commit SHAs.

Summary

Metric	Count
Files changed	4
Files scanned	3
Refs found	6
Refs pinned	6
Skipped refs	0
Warnings	0
Errors	0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

• Original refs are preserved in inline comments when possible.
• Pin comments use the Dependabot-compatible original-ref style.
• Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
• No minimum action age was enforced for this run.

Pinned refs

Location	Before	After	Resolved as
.github/workflows/lint.yml:26	actions/checkout@v7	actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1	tag
.github/workflows/lint.yml:29	actions/setup-node@v7	actions/setup-node@820762786026740c76f36085b0efc47a31fe5020	tag
.github/workflows/publish.yml:17	actions/checkout@v7	actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1	tag
.github/workflows/publish.yml:20	actions/setup-node@v7	actions/setup-node@820762786026740c76f36085b0efc47a31fe5020	tag
.github/workflows/test.yml:31	actions/checkout@v7	actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1	tag
.github/workflows/test.yml:34	actions/setup-node@v7	actions/setup-node@820762786026740c76f36085b0efc47a31fe5020	tag

Dependabot

• Added a 7-day cooldown (cooldown: default-days: 7) to the existing github-actions Dependabot configuration.
• The cooldown delays applying a newly published action release for 7 days, reducing exposure to a compromised or broken release while keeping you SHA-pinned.

---

Generated by pinner 0.1.0.

[Copilot]

🟢 Approval recommended

The SHAs match the documented releases, and the Dependabot configuration is valid.

Pull request overview

Pins GitHub Actions dependencies to immutable SHAs and adds a seven-day Dependabot cooldown.

Changes:

• Pins Checkout and Setup Node actions to verified release commits.
• Preserves readable release-version comments.
• Adds a seven-day GitHub Actions update cooldown.

File summaries

File	Description
.github/workflows/lint.yml	Pins lint workflow actions.
.github/workflows/publish.yml	Pins publishing workflow actions.
.github/workflows/test.yml	Pins test workflow actions.
.github/dependabot.yml	Adds the update cooldown.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.