From 841b82e47d7203dcd0114818769e2d06c60551b3 Mon Sep 17 00:00:00 2001
From: XananasX7 <security@example.com>
Date: Sun, 28 Jun 2026 02:11:13 +0000
Subject: [PATCH] fix(security): pin GitHub Actions to commit SHAs in
 CI/publish workflows

Mutable tag references (e.g. checkout@v2, setup-python@v1,
pypa/gh-action-pypi-publish@v1.4.2, astral-sh/setup-uv@v5) can be
silently redirected to malicious code. If a tag-pinned action runs in
a job that holds PYPI_TOKEN the attacker can publish a backdoored
release, poisoning every downstream user of this package.

Pin all action references to their immutable commit SHA. The original
tag is preserved as a comment for human readability.
---
 .github/workflows/PY-publish.yml  |  4 ++--
 .github/workflows/cli-release.yml | 10 +++++-----
 .github/workflows/python-test.yml |  4 ++--
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/PY-publish.yml b/.github/workflows/PY-publish.yml
index 963b926..932eb14 100644
--- a/.github/workflows/PY-publish.yml
+++ b/.github/workflows/PY-publish.yml
@@ -9,10 +9,10 @@ jobs:
     name: python
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5
 
       - name: Install the project
         run: uv sync --all-extras --dev
diff --git a/.github/workflows/cli-release.yml b/.github/workflows/cli-release.yml
index 18b9ce4..7447010 100644
--- a/.github/workflows/cli-release.yml
+++ b/.github/workflows/cli-release.yml
@@ -59,7 +59,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           persist-credentials: false
           submodules: recursive
@@ -119,7 +119,7 @@ jobs:
       - name: enable windows longpaths
         run: |
           git config --global core.longpaths true
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           persist-credentials: false
           submodules: recursive
@@ -182,7 +182,7 @@ jobs:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           persist-credentials: false
           submodules: recursive
@@ -234,7 +234,7 @@ jobs:
     outputs:
       val: ${{ steps.host.outputs.manifest }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           persist-credentials: false
           submodules: recursive
@@ -302,7 +302,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           persist-credentials: false
           submodules: recursive
diff --git a/.github/workflows/python-test.yml b/.github/workflows/python-test.yml
index 8fd058d..a359238 100644
--- a/.github/workflows/python-test.yml
+++ b/.github/workflows/python-test.yml
@@ -24,10 +24,10 @@ jobs:
         shell: bash
         working-directory: ./sec-gemini-python
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5
 
       - name: Install the project
         run: uv sync --all-extras --dev