From d37392954525b4646b404baa0181d9c1b2ac0e1d Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 30 May 2026 18:59:07 +0100
Subject: [PATCH] =?UTF-8?q?fix(ci):=20r-lib/actions/setup-r=20=E2=80=94=20?=
 =?UTF-8?q?replace=20fabricated=20SHA=20pin?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fake: e6be7f7e834ac48ec1e05de91168e99fc4f640e2 (gh api -> 422)
Real: a51a8012b0aab7c32ef9d19bf54da93f3254335e (r-lib/actions v2.12.0)

`r-lib/actions/setup-r` is a subpath action — the SHA pins the whole
r-lib/actions repo at the referenced commit, then the runner uses the
`setup-r/` subdir. Version comment `# v2` preserved (v2.12.0 is in the
v2 line).

Provenance: 2026-05-30 estate audit.
---
 .github/workflows/integration-tests.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index bda012b..d3b60d0 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -36,7 +36,7 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       - name: Set up R ${{ matrix.r-version }}
-        uses: r-lib/actions/setup-r@e6be7f7e834ac48ec1e05de91168e99fc4f640e2 # v2
+        uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0
         with:
           r-version: ${{ matrix.r-version }}