From 2a6e55ddf7ac26dd906f486cbc2e3dccb26e90ca Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 7 Aug 2026 04:41:53 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20Fix=20movin?=
 =?UTF-8?q?g=20and=20non-existent=20version=20tags=20in=20GitHub=20Actions?=
 =?UTF-8?q?=20workflows=20by=20pinning=20to=20secure,=20immutable=20commit?=
 =?UTF-8?q?=20SHAs.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Pin actions/checkout to immutable SHA of v4.4.0
- Pin jdx/mise-action to immutable SHA of v4.2.4
- Document the learning in the Sentinel security journal
---
 .github/workflows/check.yml | 4 ++--
 .github/workflows/docs.yml  | 4 ++--
 .jules/sentinel.md          | 5 +++++
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index e7783e7..cac2e15 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -14,8 +14,8 @@ jobs:
           - "3.13"
           - "3.12"
     steps:
-      - uses: actions/checkout@v7
-      - uses: jdx/mise-action@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
         with:
           tool_versions: |
             python ${{ matrix.python-version }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index dcf9344..ad8415b 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -10,8 +10,8 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: jdx/mise-action@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
       - name: Configure Git Credentials
         run: |
           git config user.name github-actions[bot]
diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index de39893..6cad117 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -1,3 +1,8 @@
 # Sentinel Security Journal
 
 This journal contains critical security learnings specific to this project.
+
+## 2026-03-10 - Secure GitHub Actions Pinned to Immutable SHAs
+**Vulnerability:** Workflows were referencing a non-existent version tag `actions/checkout@v7` and a mutable major version tag `jdx/mise-action@v4`. Using non-existent or moving tags exposes the repository to supply chain and tag-spoofing attacks if an attacker registers or hijacks the version tag.
+**Learning:** Third-party actions should not rely on moving major version tags or non-existent tags. Moving tags are mutable, and their associated commits can change, potentially introducing untested or malicious code.
+**Prevention:** Pin all third-party GitHub Actions to secure, immutable 40-character full-length commit SHAs, and append a comment indicating the human-readable version (e.g. `# v4.4.0`). Dependabot can then be configured to automatically update these SHAs.