Pin GitHub Actions to commit SHAs

[github-security-bot]

Pins GitHub Actions uses: references in github/freno to immutable commit SHAs.

Summary

Metric	Count
Files changed	3
Files scanned	2
Refs found	5
Refs pinned	5
Skipped refs	0
Warnings	0
Errors	0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

• Original refs are preserved in inline comments when possible.
• Pin comments use the Dependabot-compatible original-ref style.
• Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
• No minimum action age was enforced for this run.

Pinned refs

Location	Before	After	Resolved as
.github/workflows/main.yml:14	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/main.yml:17	actions/setup-go@v6	actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16	tag
.github/workflows/release.yml:18	actions/checkout@v6	actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803	tag
.github/workflows/release.yml:23	actions/setup-go@v6	actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16	tag
.github/workflows/release.yml:28	goreleaser/goreleaser-action@v6	goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a	tag

Dependabot

• Added .github/dependabot.yml enabling weekly github-actions updates with a 7-day cooldown (cooldown: default-days: 7).
• The cooldown delays applying a newly published action release for 7 days, reducing exposure to a compromised or broken release while keeping you SHA-pinned.

---

Generated by pinner 0.1.0.

[Copilot]

🟢 Approval recommended

All action references are consistently pinned and the Dependabot configuration supports ongoing secure updates.

Pull request overview

Pins GitHub Actions dependencies to immutable SHAs and configures automated updates.

Changes:

• Pins five action references with version comments.
• Adds weekly Dependabot updates with a seven-day cooldown.

File summaries

File	Description
.github/workflows/main.yml	Pins CI actions.
.github/workflows/release.yml	Pins release actions.
.github/dependabot.yml	Configures action updates.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.