Pin GitHub Actions to commit SHAs

[github-security-bot]

Pins GitHub Actions uses: references in github/balanced-employee-ip-agreement to immutable commit SHAs.

Summary

Metric	Count
Files changed	2
Files scanned	1
Refs found	2
Refs pinned	2
Skipped refs	0
Warnings	0
Errors	0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

• Original refs are preserved in inline comments when possible.
• Pin comments use the Dependabot-compatible original-ref style.
• Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
• No minimum action age was enforced for this run.

Pinned refs

Location	Before	After	Resolved as
.github/workflows/main.yml:12	actions/checkout@v2	actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e	tag
.github/workflows/main.yml:13	gaurav-nelson/github-action-markdown-link-check@v1	gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368	tag

Dependabot

• Added .github/dependabot.yml enabling weekly github-actions updates with a 7-day cooldown (cooldown: default-days: 7).
• The cooldown delays applying a newly published action release for 7 days, reducing exposure to a compromised or broken release while keeping you SHA-pinned.

---

Generated by pinner 0.1.0.

[Copilot]

🟢 Approval recommended

The focused configuration changes are internally consistent and meet the stated security objective.

Pull request overview

Pins GitHub Actions dependencies to immutable SHAs and enables automated updates.

Changes:

• Pins two workflow actions while preserving version comments.
• Adds weekly Dependabot updates with a seven-day cooldown.

File summaries

File	Description
.github/workflows/main.yml	Pins action references to commit SHAs.
.github/dependabot.yml	Configures delayed weekly action updates.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.