Pin GitHub Actions to commit SHAs

[github-security-bot]

Pins GitHub Actions uses: references in github/government.github.com to immutable commit SHAs.

Summary

Metric	Count
Files changed	6
Files scanned	5
Refs found	10
Refs pinned	10
Skipped refs	0
Warnings	5
Errors	0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

• Original refs are preserved in inline comments when possible.
• Pin comments use the Dependabot-compatible original-ref style.
• Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
• No minimum action age was enforced for this run.

Pinned refs

Location	Before	After	Resolved as
.github/workflows/build.yml:13	actions/checkout@v4	actions/checkout@11d5960a326750d5838078e36cf38b85af677262	tag
.github/workflows/build.yml:15	ruby/setup-ruby@v1	ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b	branch
.github/workflows/ensure-alphabetize.yml:25	actions/checkout@v4	actions/checkout@11d5960a326750d5838078e36cf38b85af677262	tag
.github/workflows/ensure-alphabetize.yml:27	ruby/setup-ruby@v1	ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b	branch
.github/workflows/ensure-orgs.yml:25	actions/checkout@v4	actions/checkout@11d5960a326750d5838078e36cf38b85af677262	tag
.github/workflows/ensure-orgs.yml:27	ruby/setup-ruby@v1	ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b	branch
.github/workflows/ensure-unique.yml:25	actions/checkout@v4	actions/checkout@11d5960a326750d5838078e36cf38b85af677262	tag
.github/workflows/ensure-unique.yml:27	ruby/setup-ruby@v1	ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b	branch
.github/workflows/rubucop.yml:25	actions/checkout@v4	actions/checkout@11d5960a326750d5838078e36cf38b85af677262	tag
.github/workflows/rubucop.yml:27	ruby/setup-ruby@v1	ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b	branch

Dependabot

• Added .github/dependabot.yml enabling weekly github-actions updates with a 7-day cooldown (cooldown: default-days: 7).
• The cooldown delays applying a newly published action release for 7 days, reducing exposure to a compromised or broken release while keeping you SHA-pinned.

Warnings

Location	Ref	Reason
.github/workflows/build.yml:15	ruby/setup-ruby@v1	pinned mutable branch ref 'v1' to 95ef2b042f9d; review carefully because the source branch can move
.github/workflows/ensure-alphabetize.yml:27	ruby/setup-ruby@v1	pinned mutable branch ref 'v1' to 95ef2b042f9d; review carefully because the source branch can move
.github/workflows/ensure-orgs.yml:27	ruby/setup-ruby@v1	pinned mutable branch ref 'v1' to 95ef2b042f9d; review carefully because the source branch can move
.github/workflows/ensure-unique.yml:27	ruby/setup-ruby@v1	pinned mutable branch ref 'v1' to 95ef2b042f9d; review carefully because the source branch can move
.github/workflows/rubucop.yml:27	ruby/setup-ruby@v1	pinned mutable branch ref 'v1' to 95ef2b042f9d; review carefully because the source branch can move

---

Generated by pinner 0.1.0.

[Copilot]

🟢 Approval recommended

All action SHAs match their documented release tags, and the Dependabot configuration is valid.

Pull request overview

Pins GitHub Actions to immutable SHAs and enables scheduled Dependabot updates.

Changes:

• Pins all 10 action references with version comments.
• Adds weekly GitHub Actions updates with a seven-day cooldown.

File summaries

File	Description
.github/workflows/build.yml	Pins build workflow actions.
.github/workflows/ensure-alphabetize.yml	Pins alphabetization workflow actions.
.github/workflows/ensure-orgs.yml	Pins organization-validation actions.
.github/workflows/ensure-unique.yml	Pins uniqueness-check actions.
.github/workflows/rubucop.yml	Pins lint workflow actions.
.github/dependabot.yml	Configures weekly action updates.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.