From 064849c401a191fa9ccc677dae89c602c7389db6 Mon Sep 17 00:00:00 2001
From: Luke Parke <5702154+LukasParke@users.noreply.github.com>
Date: Thu, 22 Oct 2026 17:50:09 +0000
Subject: [PATCH] ci: pin GitHub Actions to commit SHAs

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/docs-nav.yaml                       | 4 ++--
 .github/workflows/pr-validation.yaml                  | 4 ++--
 .github/workflows/sdk_generation.yaml                 | 2 +-
 .github/workflows/sdk_generation_for_spec_change.yaml | 2 +-
 .github/workflows/sdk_publish.yaml                    | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/docs-nav.yaml b/.github/workflows/docs-nav.yaml
index 51072f2e2..65d47fe24 100644
--- a/.github/workflows/docs-nav.yaml
+++ b/.github/workflows/docs-nav.yaml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -31,6 +31,6 @@ jobs:
         run: scripts/gen-docs-nav.sh
 
       - name: Auto-commit docs.json navigation
-        uses: int128/update-generated-files-action@v2
+        uses: int128/update-generated-files-action@1486b210d2f982ac40d27ef55660863b006722b0 # v2.115.0
         with:
           commit-message: "Chore: regenerate docs navigation"
diff --git a/.github/workflows/pr-validation.yaml b/.github/workflows/pr-validation.yaml
index b497b29b5..6fc2e4aec 100644
--- a/.github/workflows/pr-validation.yaml
+++ b/.github/workflows/pr-validation.yaml
@@ -17,10 +17,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           enable-cache: true
 
diff --git a/.github/workflows/sdk_generation.yaml b/.github/workflows/sdk_generation.yaml
index 24847f37a..eb84bcf40 100644
--- a/.github/workflows/sdk_generation.yaml
+++ b/.github/workflows/sdk_generation.yaml
@@ -28,7 +28,7 @@ concurrency:
 
 jobs:
   generate:
-    uses: speakeasy-api/sdk-generation-action/.github/workflows/workflow-executor.yaml@v15
+    uses: speakeasy-api/sdk-generation-action/.github/workflows/workflow-executor.yaml@68f3bfefb79354d39358bf4699863dabd2cea0f6 # v15.60.11
     with:
       force: ${{ github.event.inputs.force }}
       mode: pr
diff --git a/.github/workflows/sdk_generation_for_spec_change.yaml b/.github/workflows/sdk_generation_for_spec_change.yaml
index 697b0a6d7..5ab180751 100644
--- a/.github/workflows/sdk_generation_for_spec_change.yaml
+++ b/.github/workflows/sdk_generation_for_spec_change.yaml
@@ -29,7 +29,7 @@ concurrency:
 jobs:
   generate:
     if: github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch'
-    uses: speakeasy-api/sdk-generation-action/.github/workflows/workflow-executor.yaml@v15
+    uses: speakeasy-api/sdk-generation-action/.github/workflows/workflow-executor.yaml@68f3bfefb79354d39358bf4699863dabd2cea0f6 # v15.60.11
     with:
       force: ${{ github.event.inputs.force }}
       mode: pr
diff --git a/.github/workflows/sdk_publish.yaml b/.github/workflows/sdk_publish.yaml
index 0d3f1a01f..5a2a0339f 100644
--- a/.github/workflows/sdk_publish.yaml
+++ b/.github/workflows/sdk_publish.yaml
@@ -14,7 +14,7 @@ permissions:
   workflow_dispatch: {}
 jobs:
   publish:
-    uses: speakeasy-api/sdk-generation-action/.github/workflows/sdk-publish.yaml@v15
+    uses: speakeasy-api/sdk-generation-action/.github/workflows/sdk-publish.yaml@68f3bfefb79354d39358bf4699863dabd2cea0f6 # v15.60.11
     with:
       target: open-router
     secrets: