pin all GitHub Actions to commit SHAs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: evios

.github/workflows/generate-digest-daily.yml

@@ -49,8 +49,8 @@ jobs:
   read:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
 
@@ -65,7 +65,7 @@ jobs:
           [ -n "$END_DATE" ] && ARGS="$ARGS --end-date $END_DATE"
           python telegram.py --read $ARGS
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: messages
           path: /tmp/telegram_messages.json
@@ -77,14 +77,14 @@ jobs:
     if: ${{ github.event.inputs.publish_telegram != 'false' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/download-artifact@v7
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: messages
           path: /tmp
 
       - name: Generate Telegram digest
-        uses: aicmo/llm-call-action@33f54e4a002d7942f3bb4102e3bf0632069d7e42 # v1.1.3
+        uses: aicmo/llm-call-action@ab5ee218f5338ef5b85d61babc78b856a8b53dc5 # v1.1.4
         with:
           prompt_file: .github/prompts/generate-digest-daily-messenger.md
           data_file: /tmp/telegram_messages.json
@@ -102,7 +102,7 @@ jobs:
           max_turns: '12'
           claude_tools: 'Read'
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: messenger-digest
           path: /tmp/telegram_digest.txt
@@ -114,14 +114,14 @@ jobs:
     if: ${{ github.event.inputs.publish_ghost != 'false' || github.event.inputs.publish_substack != 'false' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/download-artifact@v7
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: messages
           path: /tmp
 
       - name: Generate blog digest
-        uses: aicmo/llm-call-action@33f54e4a002d7942f3bb4102e3bf0632069d7e42 # v1.1.3
+        uses: aicmo/llm-call-action@ab5ee218f5338ef5b85d61babc78b856a8b53dc5 # v1.1.4
         with:
           prompt_file: .github/prompts/generate-digest-daily-blog.md
           data_file: /tmp/telegram_messages.json
@@ -139,7 +139,7 @@ jobs:
           max_turns: '12'
           claude_tools: 'Read'
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: blog-digest
           path: /tmp/blog_digest.txt
@@ -151,11 +151,11 @@ jobs:
     if: ${{ github.event.inputs.publish_telegram != 'false' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: messenger-digest
       - name: Publish
@@ -171,11 +171,11 @@ jobs:
     if: ${{ github.event.inputs.publish_ghost != 'false' }}
     runs-on: self-hosted
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: blog-digest
       - name: Publish
@@ -192,11 +192,11 @@ jobs:
     if: ${{ github.event.inputs.publish_substack != 'false' }}
     runs-on: self-hosted
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: blog-digest
       - name: Publish

.github/workflows/generate-digest-weekly.yml

@@ -49,8 +49,8 @@ jobs:
   read:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
 
@@ -65,7 +65,7 @@ jobs:
           python telegram.py --read --channel "$TELEGRAM_PUBLISH_CHANNEL" \
             --start-date "$START_DATE" --end-date "$END_DATE" --resolve-links
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: messages
           path: /tmp/telegram_messages.json
@@ -77,14 +77,14 @@ jobs:
     if: ${{ github.event.inputs.publish_telegram != 'false' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/download-artifact@v7
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: messages
           path: /tmp
 
       - name: Generate weekly Telegram digest
-        uses: aicmo/llm-call-action@33f54e4a002d7942f3bb4102e3bf0632069d7e42 # v1.1.3
+        uses: aicmo/llm-call-action@ab5ee218f5338ef5b85d61babc78b856a8b53dc5 # v1.1.4
         with:
           prompt_file: .github/prompts/generate-digest-weekly-messenger.md
           data_file: /tmp/telegram_messages.json
@@ -102,7 +102,7 @@ jobs:
           max_turns: '12'
           claude_tools: 'Read'
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: messenger-digest
           path: /tmp/telegram_digest.txt
@@ -114,14 +114,14 @@ jobs:
     if: ${{ github.event.inputs.publish_ghost != 'false' || github.event.inputs.publish_substack != 'false' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/download-artifact@v7
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: messages
           path: /tmp
 
       - name: Generate weekly blog digest
-        uses: aicmo/llm-call-action@33f54e4a002d7942f3bb4102e3bf0632069d7e42 # v1.1.3
+        uses: aicmo/llm-call-action@ab5ee218f5338ef5b85d61babc78b856a8b53dc5 # v1.1.4
         with:
           prompt_file: .github/prompts/generate-digest-weekly-blog.md
           data_file: /tmp/telegram_messages.json
@@ -139,7 +139,7 @@ jobs:
           max_turns: '12'
           claude_tools: 'Read'
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: blog-digest
           path: /tmp/blog_digest.txt
@@ -151,11 +151,11 @@ jobs:
     if: ${{ github.event.inputs.publish_telegram != 'false' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: messenger-digest
       - name: Publish
@@ -171,11 +171,11 @@ jobs:
     if: ${{ github.event.inputs.publish_ghost != 'false' }}
     runs-on: self-hosted
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: blog-digest
       - name: Publish
@@ -195,11 +195,11 @@ jobs:
     if: ${{ github.event.inputs.publish_substack != 'false' }}
     runs-on: self-hosted
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: blog-digest
       - name: Publish

.github/workflows/test-ghost.yml

@@ -18,10 +18,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
 

.github/workflows/test-substack.yml

@@ -18,10 +18,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
 

.github/workflows/test-unit.yml

@@ -10,8 +10,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'