From bb85dc3cbd1730017d4a403e47221fba79476ed6 Mon Sep 17 00:00:00 2001
From: Takahisa Iwamoto <takahisa_iwamoto@caddi.jptakahisa_iwamoto@caddi.jp>
Date: Tue, 31 Mar 2026 12:37:38 +0900
Subject: [PATCH] ci: pin GitHub Actions to commit hashes via pinact

---
 .github/workflows/ci.yml                 | 24 ++++++++++++------------
 .github/workflows/create-cli-deps-pr.yml |  4 ++--
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ffa194d014c12..7c754f1df2606 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,9 +7,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Checkout the npm/cli repo
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       - name: Use Node.js 14.x
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6
         with:
           node-version: 14.x
       - name: Install dependencies
@@ -24,9 +24,9 @@ jobs:
   check_docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       - name: Use Node.js 14.x
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6
         with:
           node-version: 14.x
       - name: Install dependencies
@@ -42,9 +42,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Checkout the npm/cli repo
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       - name: Use Node.js 14.x
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6
         with:
           node-version: 14.x
       - name: Install dependencies
@@ -76,11 +76,11 @@ jobs:
 
     steps:
       # Checkout the npm/cli repo
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
       # Installs the specific version of Node.js
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
+      uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6
       with:
         node-version: ${{ matrix.node-version }}
 
@@ -118,11 +118,11 @@ jobs:
 
     steps:
       # Checkout the npm/cli repo
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
       # Installs the specific version of Node.js
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
+      uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6
       with:
         node-version: ${{ matrix.node-version }}
 
@@ -159,11 +159,11 @@ jobs:
 
     steps:
       # Checkout the npm/cli repo
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
       # Installs the specific version of Node.js
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
+      uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6
       with:
         node-version: ${{ matrix.node-version }}
 
diff --git a/.github/workflows/create-cli-deps-pr.yml b/.github/workflows/create-cli-deps-pr.yml
index a59302ebeb0ac..0b2295cd1b3f9 100644
--- a/.github/workflows/create-cli-deps-pr.yml
+++ b/.github/workflows/create-cli-deps-pr.yml
@@ -24,7 +24,7 @@ jobs:
           sudo apt-get install -y jq
           sudo apt install gh
       - name: Checkout npm/node
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
         with:
           fetch-depth: 0
           ref: master
@@ -32,7 +32,7 @@ jobs:
           token: ${{ secrets.NPM_ROBOT_USER_PAT }}
       - name: Pull (Fast-Forward) upstream
         id: sync
-        uses: aormsby/Fork-Sync-With-Upstream-action@v2.1
+        uses: aormsby/Fork-Sync-With-Upstream-action@3911125c30210b7f1ea2b46ac84722aff061d257 # v2.1
         with:
           upstream_repository: nodejs/node
           upstream_branch: master