From d968e8c6b97d1d5fcf5c80f07f22917a567aa70c Mon Sep 17 00:00:00 2001
From: VictoriaBeilstenEdmands
 <45741274+VictoriaBeilsten-Edmands@users.noreply.github.com>
Date: Thu, 15 Oct 2026 08:46:13 +0100
Subject: [PATCH] Use SHA for GitHub action versions

---
 .github/workflows/deploy-storybook.yaml        | 6 +++---
 .github/workflows/npm-publish-pre-release.yaml | 6 +++---
 .github/workflows/npm-publish.yaml             | 6 +++---
 .github/workflows/osv-scanner.yml              | 6 +++---
 .github/workflows/test-build.yaml              | 6 +++---
 5 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/deploy-storybook.yaml b/.github/workflows/deploy-storybook.yaml
index ec4f369a..c77f2a60 100644
--- a/.github/workflows/deploy-storybook.yaml
+++ b/.github/workflows/deploy-storybook.yaml
@@ -22,10 +22,10 @@ jobs:
         node-version: ["22.20.0"]
  
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Setup pnpm
-      uses: pnpm/action-setup@v6
+      uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
     - name: Set Node.js ${{ matrix.node-version }}
       uses: actions/setup-node@v7
@@ -38,7 +38,7 @@ jobs:
 
     - name: Build and publish
       id: build-publish
-      uses: bitovi/github-actions-storybook-to-github-pages@v1.0.4
+      uses: bitovi/github-actions-storybook-to-github-pages@ddd9d35f670cceedd2bfc444be681001b0709730 # v1.0.4
       with:
         checkout: false
         path: storybook-static
diff --git a/.github/workflows/npm-publish-pre-release.yaml b/.github/workflows/npm-publish-pre-release.yaml
index 9388c0e0..defba8fa 100644
--- a/.github/workflows/npm-publish-pre-release.yaml
+++ b/.github/workflows/npm-publish-pre-release.yaml
@@ -20,13 +20,13 @@ jobs:
     environment: release
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
       - name: Setup node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22.20.0'
           registry-url: https://registry.npmjs.org/
diff --git a/.github/workflows/npm-publish.yaml b/.github/workflows/npm-publish.yaml
index 3091b00c..3bd9d870 100644
--- a/.github/workflows/npm-publish.yaml
+++ b/.github/workflows/npm-publish.yaml
@@ -21,13 +21,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
       - name: Setup node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22.20.0'
           registry-url: https://registry.npmjs.org/
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index 352bfd4b..d66da2f9 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -21,18 +21,18 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run OSV Scanner (human-readable)
         continue-on-error: true
-        uses: google/osv-scanner-action/osv-scanner-action@v2.6.0
+        uses: google/osv-scanner-action/osv-scanner-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc # v2.6.0
         with:
           scan-args: |
             --lockfile=pnpm-lock.yaml
 
       - name: Run OSV Scanner (JSON)
         continue-on-error: true
-        uses: google/osv-scanner-action/osv-scanner-action@v2.6.0
+        uses: google/osv-scanner-action/osv-scanner-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc # v2.6.0
         with:
           scan-args: |
             --format=json
diff --git a/.github/workflows/test-build.yaml b/.github/workflows/test-build.yaml
index 60c7167d..870d7d38 100644
--- a/.github/workflows/test-build.yaml
+++ b/.github/workflows/test-build.yaml
@@ -18,13 +18,13 @@ jobs:
         node-version: ["22.20.0"]
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Setup pnpm
-      uses: pnpm/action-setup@v6
+      uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
     - name: Set Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ matrix.node-version }}