## Background Third-party actions aren't pinned by SHA. ## Why it matters Supply-chain safety. ## Acceptance criteria - [ ] Pin actions to commit SHAs with comments. - [ ] Audit all workflows. ## Where to look - `.github/workflows/` ## How to claim Comment `/claim` on this issue.
Background
Third-party actions aren't pinned by SHA.
Why it matters
Supply-chain safety.
Acceptance criteria
Where to look
.github/workflows/How to claim
Comment
/claimon this issue.