From 2f4439d9efeacbc8d3c2525f470db19dbe4d285b Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 4 Sep 2026 04:33:38 +0000
Subject: [PATCH 1/2] security: pin GitHub Actions to full commit SHAs

Pins third-party GitHub Actions (`actions/checkout` and `jdx/mise-action`)
to full immutable commit SHAs in CI workflows (`check.yml` and `docs.yml`).
This mitigates supply chain risks and tag-spoofing vulnerabilities.
---
 .github/workflows/check.yml | 4 ++--
 .github/workflows/docs.yml  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 2036fdb..21b4697 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -17,8 +17,8 @@ jobs:
           - "3.13"
           - "3.12"
     steps:
-      - uses: actions/checkout@v7
-      - uses: jdx/mise-action@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: jdx/mise-action@500809d363d3fb4f307ee44f24ef3381a1792a7e # v2
         with:
           tool_versions: |
             python ${{ matrix.python-version }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index dcf9344..ade41c4 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -10,8 +10,8 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: jdx/mise-action@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: jdx/mise-action@500809d363d3fb4f307ee44f24ef3381a1792a7e # v2
       - name: Configure Git Credentials
         run: |
           git config user.name github-actions[bot]

From 41e90b87c2abe3a6ebcf6df35a4ff80c9b0dc4df Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 4 Sep 2026 04:37:17 +0000
Subject: [PATCH 2/2] security: pin GitHub Actions to valid full commit SHAs

Pins third-party GitHub Actions (`actions/checkout` and `jdx/mise-action`)
to full immutable commit SHAs (`actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683`
and `jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c`) in CI workflows.
This resolves CI workflow failures and protects against supply chain attacks.
---
 .github/workflows/check.yml | 2 +-
 .github/workflows/docs.yml  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 21b4697..1e19d99 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -18,7 +18,7 @@ jobs:
           - "3.12"
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: jdx/mise-action@500809d363d3fb4f307ee44f24ef3381a1792a7e # v2
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           tool_versions: |
             python ${{ matrix.python-version }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index ade41c4..04eedcd 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: jdx/mise-action@500809d363d3fb4f307ee44f24ef3381a1792a7e # v2
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
       - name: Configure Git Credentials
         run: |
           git config user.name github-actions[bot]