From 0d896d98f524250ad254dbffca68f4027f673e77 Mon Sep 17 00:00:00 2001 From: Marco Acierno Date: Sat, 7 Nov 2026 02:46:45 +0100 Subject: [PATCH] Pin GitHub Actions to commit SHAs Tags are mutable, so a compromised or retagged action could change what runs in CI. Every external action is pinned to the commit its current tag resolves to, with the exact release in a trailing comment for Dependabot. actions/checkout@master in opentofu-lint is pinned to v6.1.0 to match the other workflows. Dependabot now tracks the github-actions ecosystem weekly in one grouped PR, with a 7-day cooldown so new releases age before being proposed. --- .github/dependabot.yml | 13 ++++++++++ .github/workflows/ai-code-review.yml | 6 ++--- .github/workflows/backend-checks.yml | 6 ++--- .github/workflows/backend-test.yml | 6 ++--- .github/workflows/build-backend.yml | 10 ++++---- .github/workflows/build-base-pretix.yml | 8 +++---- .github/workflows/build-frontend.yml | 12 +++++----- .github/workflows/build-pretix.yml | 10 ++++---- .github/workflows/claude.yml | 14 +++++------ .github/workflows/deploy.yml | 24 +++++++++---------- .github/workflows/frontend-lint.yml | 8 +++---- .github/workflows/global-terraform-deploy.yml | 4 ++-- .github/workflows/global-terraform-lint.yml | 4 ++-- .github/workflows/graphql-schema-diff.yml | 4 ++-- .github/workflows/graphql-schema.yml | 6 ++--- .github/workflows/opentofu-lint.yml | 8 +++---- .github/workflows/slash-commands.yml | 6 ++--- 17 files changed, 81 insertions(+), 68 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1d7a7e4ae0..6eede1c7ea 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -101,3 +101,16 @@ updates: versions: - 4.0.1 - 4.0.2 +- package-ecosystem: github-actions + directory: "/" + schedule: + interval: weekly + day: monday + time: "04:00" + cooldown: + default-days: 7 + open-pull-requests-limit: 10 + groups: + github-actions: + patterns: + - "*" diff --git a/.github/workflows/ai-code-review.yml b/.github/workflows/ai-code-review.yml index 8976272fa4..aea1dfba77 100644 --- a/.github/workflows/ai-code-review.yml +++ b/.github/workflows/ai-code-review.yml @@ -20,11 +20,11 @@ jobs: actions: read steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 1 - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b + uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 id: setup-uv with: version: "0.12.5" @@ -48,7 +48,7 @@ jobs: echo "comment_id=" >> $GITHUB_OUTPUT fi - name: Review code - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@61a9c274fa7110a66dfafc1bbbced03833eb25fe # v1.0.269 with: claude_code_oauth_token: ${{ secrets.CLAUDE_OAUTH_TOKEN }} prompt: | diff --git a/.github/workflows/backend-checks.yml b/.github/workflows/backend-checks.yml index 28d2a586b2..969290ceec 100644 --- a/.github/workflows/backend-checks.yml +++ b/.github/workflows/backend-checks.yml @@ -15,12 +15,12 @@ jobs: working-directory: backend steps: - - uses: actions/checkout@v6 - - uses: actions/setup-python@v5 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.14.7" - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b + uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 id: setup-uv with: version: "0.12.5" diff --git a/.github/workflows/backend-test.yml b/.github/workflows/backend-test.yml index 5c8fece86e..55e7d33a53 100644 --- a/.github/workflows/backend-test.yml +++ b/.github/workflows/backend-test.yml @@ -35,12 +35,12 @@ jobs: - 6379:6379 steps: - - uses: actions/checkout@v6 - - uses: actions/setup-python@v5 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.14.7" - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b + uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 id: setup-uv with: version: "0.12.5" diff --git a/.github/workflows/build-backend.yml b/.github/workflows/build-backend.yml index 79ea430e39..e100d673f6 100644 --- a/.github/workflows/build-backend.yml +++ b/.github/workflows/build-backend.yml @@ -10,23 +10,23 @@ jobs: name: Build runs-on: ubuntu-24.04-arm steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ github.ref }} fetch-depth: 0 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: aws-access-key-id: ${{ secrets.aws_access_key_id }} aws-secret-access-key: ${{ secrets.aws_secret_access_key }} aws-region: eu-central-1 - name: Login to Amazon ECR - uses: aws-actions/amazon-ecr-login@v2 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7 - name: Set up Docker Buildx id: buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Build and push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 with: context: ./backend file: ./backend/Dockerfile diff --git a/.github/workflows/build-base-pretix.yml b/.github/workflows/build-base-pretix.yml index b77d289650..1673045397 100644 --- a/.github/workflows/build-base-pretix.yml +++ b/.github/workflows/build-base-pretix.yml @@ -19,20 +19,20 @@ jobs: packages: write steps: - name: Log in to the Container registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: repository: pretix/pretix ref: ${{ inputs.version }} - name: Set up Docker Buildx id: buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Build pretix base - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 id: build-pretix-base with: context: . diff --git a/.github/workflows/build-frontend.yml b/.github/workflows/build-frontend.yml index 2c65da6af4..edff5ee185 100644 --- a/.github/workflows/build-frontend.yml +++ b/.github/workflows/build-frontend.yml @@ -13,23 +13,23 @@ jobs: name: Build runs-on: ubuntu-24.04-arm steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ github.ref }} fetch-depth: 0 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: aws-access-key-id: ${{ secrets.aws_access_key_id }} aws-secret-access-key: ${{ secrets.aws_secret_access_key }} aws-region: eu-central-1 - name: Set up QEMU dependency - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0 - name: Login to Amazon ECR - uses: aws-actions/amazon-ecr-login@v2 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7 - name: Set up Docker Buildx id: buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Get vars id: vars run: | @@ -43,7 +43,7 @@ jobs: echo "::add-mask::$sentry_auth_token" echo "SENTRY_AUTH_TOKEN=$sentry_auth_token" >> "$GITHUB_OUTPUT" - name: Build and push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 with: context: ./frontend file: ./frontend/Dockerfile diff --git a/.github/workflows/build-pretix.yml b/.github/workflows/build-pretix.yml index 580cc3429c..082a4886bb 100644 --- a/.github/workflows/build-pretix.yml +++ b/.github/workflows/build-pretix.yml @@ -10,23 +10,23 @@ jobs: name: Build pretix runs-on: ubuntu-24.04-arm steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ github.ref }} fetch-depth: 0 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: aws-access-key-id: ${{ secrets.aws_access_key_id }} aws-secret-access-key: ${{ secrets.aws_secret_access_key }} aws-region: eu-central-1 - name: Login to Amazon ECR - uses: aws-actions/amazon-ecr-login@v2 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7 - name: Set up Docker Buildx id: buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Build and push pretix - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 with: context: ./pretix file: ./pretix/Dockerfile diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index efd3e829fc..9303dbcb24 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -65,14 +65,14 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 1 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.14.7" - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b + uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 id: setup-uv with: version: "0.12.5" @@ -81,11 +81,11 @@ jobs: working-directory: backend run: uv sync - name: Install pnpm - uses: pnpm/action-setup@v6 + uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1 with: run_install: false package_json_file: frontend/package.json - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: "26.10.0" cache: "pnpm" @@ -94,7 +94,7 @@ jobs: working-directory: frontend run: pnpm install - name: Run Claude - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@61a9c274fa7110a66dfafc1bbbced03833eb25fe # v1.0.269 with: claude_code_oauth_token: ${{ secrets.CLAUDE_OAUTH_TOKEN }} assignee_trigger: "pythonitaliabot2" @@ -107,7 +107,7 @@ jobs: # actual error lives here. Without this, failures are undiagnosable. - name: Upload Claude execution log if: failure() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: claude-execution-output path: ${{ runner.temp }}/claude-execution-output.json diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 5955260827..f8bca72934 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -19,12 +19,12 @@ jobs: image_exists: ${{ steps.image.outputs.image_exists }} githash: ${{ steps.git.outputs.githash }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ github.ref }} fetch-depth: 0 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: aws-access-key-id: ${{ secrets.aws_access_key_id }} aws-secret-access-key: ${{ secrets.aws_secret_access_key }} @@ -52,12 +52,12 @@ jobs: image_exists: ${{ steps.image.outputs.image_exists }} githash: ${{ steps.git.outputs.githash }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ github.ref }} fetch-depth: 0 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: aws-access-key-id: ${{ secrets.aws_access_key_id }} aws-secret-access-key: ${{ secrets.aws_secret_access_key }} @@ -85,12 +85,12 @@ jobs: image_exists: ${{ steps.image.outputs.image_exists }} githash: ${{ steps.git.outputs.githash }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ github.ref }} fetch-depth: 0 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: aws-access-key-id: ${{ secrets.aws_access_key_id }} aws-secret-access-key: ${{ secrets.aws_secret_access_key }} @@ -140,11 +140,11 @@ jobs: run: working-directory: ./infrastructure/applications steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ github.ref }} fetch-depth: 0 - - uses: opentofu/setup-opentofu@v2 + - uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2 with: tofu_version: 1.9.0 - name: OpenTofu Init @@ -170,7 +170,7 @@ jobs: needs: [deploy-be, check-backend-build] if: always() && !cancelled() && !failure() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ github.ref }} fetch-depth: 0 @@ -201,11 +201,11 @@ jobs: run: working-directory: ./infrastructure/applications steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ github.ref }} fetch-depth: 0 - - uses: opentofu/setup-opentofu@v2 + - uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2 with: tofu_version: 1.9.0 - name: OpenTofu Init @@ -231,7 +231,7 @@ jobs: needs: [deploy-fe, check-frontend-build] if: always() && !cancelled() && !failure() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: ref: ${{ github.ref }} fetch-depth: 0 diff --git a/.github/workflows/frontend-lint.yml b/.github/workflows/frontend-lint.yml index f525cfac22..15dc262c53 100644 --- a/.github/workflows/frontend-lint.yml +++ b/.github/workflows/frontend-lint.yml @@ -15,19 +15,19 @@ jobs: run: working-directory: ./frontend steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1 name: Install pnpm with: run_install: false package_json_file: frontend/package.json - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: '26.10.0' cache: 'pnpm' cache-dependency-path: 'frontend/pnpm-lock.yaml' - name: Setup Biome - uses: biomejs/setup-biome@v2 + uses: biomejs/setup-biome@4c91541eaada48f67d7dbd7833600ce162b68f51 # v2.7.1 with: version: 1.9.4 - name: Install dependencies diff --git a/.github/workflows/global-terraform-deploy.yml b/.github/workflows/global-terraform-deploy.yml index 37d28b1bd3..6808456a44 100644 --- a/.github/workflows/global-terraform-deploy.yml +++ b/.github/workflows/global-terraform-deploy.yml @@ -18,8 +18,8 @@ jobs: run: working-directory: ./infrastructure/global steps: - - uses: actions/checkout@v6 - - uses: hashicorp/setup-terraform@v3 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: 1.2.4 - name: Terraform Init diff --git a/.github/workflows/global-terraform-lint.yml b/.github/workflows/global-terraform-lint.yml index cba6aa24d9..862627bf3e 100644 --- a/.github/workflows/global-terraform-lint.yml +++ b/.github/workflows/global-terraform-lint.yml @@ -14,8 +14,8 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v6 - - uses: hashicorp/setup-terraform@v3 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 with: terraform_version: 1.2.4 - name: Terraform Format diff --git a/.github/workflows/graphql-schema-diff.yml b/.github/workflows/graphql-schema-diff.yml index 9cdb6e48af..682de1d8b5 100644 --- a/.github/workflows/graphql-schema-diff.yml +++ b/.github/workflows/graphql-schema-diff.yml @@ -17,12 +17,12 @@ jobs: steps: - name: Check out repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: "26" diff --git a/.github/workflows/graphql-schema.yml b/.github/workflows/graphql-schema.yml index 38c7bb1989..3183c56cac 100644 --- a/.github/workflows/graphql-schema.yml +++ b/.github/workflows/graphql-schema.yml @@ -16,16 +16,16 @@ jobs: steps: - name: Check out repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: persist-credentials: false - - uses: actions/setup-python@v5 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.14.7" - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b + uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: version: "0.12.5" enable-cache: true diff --git a/.github/workflows/opentofu-lint.yml b/.github/workflows/opentofu-lint.yml index 5528d43a19..638f8d05ed 100644 --- a/.github/workflows/opentofu-lint.yml +++ b/.github/workflows/opentofu-lint.yml @@ -20,9 +20,9 @@ jobs: steps: - name: Clone repo - uses: actions/checkout@master + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: tfsec - uses: aquasecurity/tfsec-pr-commenter-action@v1.2.0 + uses: aquasecurity/tfsec-pr-commenter-action@1015a3975c7f1400ee4d9f423a7786a3df9fcbec # v1.2.0 with: github_token: ${{ github.token }} @@ -30,8 +30,8 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v6 - - uses: opentofu/setup-opentofu@v1 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: opentofu/setup-opentofu@9d84900f3238fab8cd84ce47d658d25dd008be2f # v1.0.8 with: tofu_version: 1.9.0 - name: OpenTofu Format diff --git a/.github/workflows/slash-commands.yml b/.github/workflows/slash-commands.yml index 86aabd6b85..1cdaee00cd 100644 --- a/.github/workflows/slash-commands.yml +++ b/.github/workflows/slash-commands.yml @@ -8,7 +8,7 @@ jobs: slash-command-dispatch: runs-on: ubuntu-24.04 steps: - - uses: actions/github-script@v3 + - uses: actions/github-script@ffc2c79a5b2490bd33e0a41c1de74b877714d736 # v3.2.0 id: get-pr with: script: | @@ -25,7 +25,7 @@ jobs: core.setFailed(`Request failed with error ${err}`) } - name: Slash Command Dispatch - uses: peter-evans/slash-command-dispatch@v2 + uses: peter-evans/slash-command-dispatch@40877f718dce0101edfc7aea2b3800cc192f9ed5 # v2.3.0 with: token: ${{ secrets.BOT_TOKEN }} reaction-token: ${{ secrets.BOT_TOKEN }} @@ -40,7 +40,7 @@ jobs: ref=${{ fromJSON(steps.get-pr.outputs.result).head.ref }} - name: Edit comment with error message if: steps.scd.outputs.error-message - uses: peter-evans/create-or-update-comment@v1 + uses: peter-evans/create-or-update-comment@a35cf36e5301d70b76f316e867e7788a55a31dae # v1.4.5 with: comment-id: ${{ github.event.comment.id }} body: |