chore: standardize GitHub Actions version pins in workflows (hiero-ledger#2381)

blaze1425 · web-flow · commit 891808a6c8ab · 2026-06-26T12:44:41.000-04:00
Signed-off-by: blaze1425 &lt;242436131+blaze1425@users.noreply.github.com&gt;
diff --git a/.github/workflows/bot-assignment-check.yml b/.github/workflows/bot-assignment-check.yml
@@ -17,7 +17,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Check Assignment Count
         env:
diff --git a/.github/workflows/bot-beginner-assign-on-comment.yml b/.github/workflows/bot-beginner-assign-on-comment.yml
@@ -31,7 +31,7 @@ jobs:
               uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Run Beginner /assign handler
-              uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0
+              uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
               with:
                   script: |
                       const script = require('./.github/scripts/bot-beginner-assign-on-comment.js');
diff --git a/.github/workflows/bot-gfi-assign-on-comment.yml b/.github/workflows/bot-gfi-assign-on-comment.yml
@@ -32,7 +32,7 @@ jobs:
               uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Run GFI /assign handler
-              uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0
+              uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
               with:
                   script: |
                       const script = require('./.github/scripts/bot-gfi-assign-on-comment.js');
diff --git a/.github/workflows/bot-gfi-candidate-notification.yaml b/.github/workflows/bot-gfi-candidate-notification.yaml
@@ -21,18 +21,18 @@ jobs:
 
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Notify team of GFI candidate
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DRY_RUN: ${{ github.repository_owner != 'hiero-ledger' }}
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  #v9.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const script = require('./.github/scripts/bot-gfi-candidate-notification.js');
diff --git a/.github/workflows/bot-inactivity-unassign.yml b/.github/workflows/bot-inactivity-unassign.yml
@@ -22,10 +22,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Harden the runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/bot-next-issue-recommendation.yml b/.github/workflows/bot-next-issue-recommendation.yml
@@ -34,7 +34,7 @@ jobs:
           ref: ${{ github.event.repository.default_branch }}
 
       - name: Recommend next issue
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/bot-p0-issues-notify-team.yml b/.github/workflows/bot-p0-issues-notify-team.yml
@@ -25,12 +25,12 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Notify team of P0 issues
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const script = require('./.github/scripts/bot-p0-issues-notify-team.js');
diff --git a/.github/workflows/cron-calls-community.yml b/.github/workflows/cron-calls-community.yml
@@ -27,12 +27,12 @@ jobs:
         runs-on: hl-sdk-py-lin-md
         steps:
             - name: Harden the runner
-              uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 #2.19.4
+              uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
               with:
                   egress-policy: audit
 
             - name: Checkout repository
-              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Check Schedule and Notify
               env:
diff --git a/.github/workflows/cron-calls-office-hours.yml b/.github/workflows/cron-calls-office-hours.yml
@@ -26,12 +26,12 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 #2.19.4
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Check Schedule and Notify
         env:
diff --git a/.github/workflows/cron-enforcer-pr-linked-issue.yml b/.github/workflows/cron-enforcer-pr-linked-issue.yml
@@ -28,14 +28,14 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Enforce linked issues on PRs
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DRY_RUN: ${{ env.DRY_RUN }}
           HOURS_BEFORE_CLOSE: "24"
           REQUIRE_AUTHOR_ASSIGNED: "true"
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const script = require('./.github/scripts/cron-enforcer-pr-linked-issue.js');
diff --git a/.github/workflows/cron-reminder-issue-no-pr.yml b/.github/workflows/cron-reminder-issue-no-pr.yml
@@ -22,12 +22,12 @@ jobs:
 
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Post reminder on assigned issues with no PRs
         env:
diff --git a/.github/workflows/cron-reminder-pr-inactive.yml b/.github/workflows/cron-reminder-pr-inactive.yml
@@ -29,12 +29,12 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Remind authors of inactive PRs
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DRY_RUN: ${{ env.DRY_RUN }}
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const script = require('./.github/scripts/cron-reminder-pr-inactive.js')
diff --git a/.github/workflows/on-review.yml b/.github/workflows/on-review.yml
@@ -37,7 +37,7 @@ jobs:
           persist-credentials: false
 
       - name: Run Add Reviewers as Assignees
-        uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const script = require('./.github/scripts/bot-pr-add-reviewers-as-assignees.js');
diff --git a/.github/workflows/pr-check-primary-codeql.yml b/.github/workflows/pr-check-primary-codeql.yml
@@ -42,7 +42,7 @@ jobs:
                   egress-policy: audit
 
             - name: Initialize CodeQL
-              uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.3.5
+              uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
               with:
                   languages: ${{ matrix.language }}
                   build-mode: ${{ matrix.build-mode }}
@@ -66,6 +66,6 @@ jobs:
               run: uv sync --frozen --all-groups --all-packages --all-extras
 
             - name: Perform CodeQL Analysis
-              uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.3.5
+              uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
               with:
                   category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/pr-check-primary-test-files.yml b/.github/workflows/pr-check-primary-test-files.yml
@@ -29,7 +29,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository (shallow)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 1 # Only fetch the latest commit
 
diff --git a/.github/workflows/pr-check-secondary-examples.yml b/.github/workflows/pr-check-secondary-examples.yml
@@ -44,7 +44,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/release-pr-coderabbit-gate.yml b/.github/workflows/release-pr-coderabbit-gate.yml
@@ -30,12 +30,12 @@ jobs:
             egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Post CodeRabbit release-gate prompt comment
         env:
             GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const script = require('./.github/scripts/release-pr-coderabbit-gate.js');
diff --git a/.github/workflows/unassign-on-comment.yml b/.github/workflows/unassign-on-comment.yml
@@ -22,15 +22,15 @@ jobs:
 
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Run /unassign handler
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const script = require('./.github/scripts/bot-unassign-on-comment.js');
