From b917253b8a4a8e366eb50660e6e71fe294dfc39c Mon Sep 17 00:00:00 2001
From: Felix Arntz <flixos90@gmail.com>
Date: Sun, 9 Aug 2026 20:25:48 -0500
Subject: [PATCH 1/2] ensure all 3P actions are pinned

---
 action.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/action.yml b/action.yml
index 7b95742..1ad2105 100644
--- a/action.yml
+++ b/action.yml
@@ -85,7 +85,7 @@ runs:
   using: "composite"
   steps:
     - name: Set up Node
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: '24'
 
@@ -119,7 +119,7 @@ runs:
         WP_VERSION: ${{ inputs.wp-version == 'trunk' && '"WordPress/WordPress#master"' || 'null' }}
 
     - name: Start wp-env
-      uses: nick-fields/retry@v4
+      uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
       with:
         timeout_minutes: 10
         max_attempts: 3

From b634208822ade1fccae2ec37e05bca28d1feaccc Mon Sep 17 00:00:00 2001
From: Felix Arntz <flixos90@gmail.com>
Date: Sun, 9 Aug 2026 20:27:33 -0500
Subject: [PATCH 2/2] ensure workflows also use pinned SHAs for 3P actions

---
 .github/workflows/auto-merge.yml | 2 +-
 .github/workflows/test.yml       | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index d4a0ee6..31475dd 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -12,7 +12,7 @@ jobs:
         steps:
             - name: Dependabot metadata
               id: metadata
-              uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v1.3.3
+              uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
               with:
                   github-token: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 236225a..c68e5c1 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Run plugin check (default)
         uses: ./