kobihikri 005a7b747f ci: pin ad-m/github-push-action to a full commit SHA ...

The release-pr job passes GITHUB_TOKEN to ad-m/github-push-action, which
is referenced by the mutable `@master` branch. A mutable ref means the
exact code that runs with the token can change without any change in this
repository. Pinning to a full commit SHA makes the action immutable while
keeping the current behaviour.

881a6320fdb16eb5318c5054f31c218aec2b324c is the commit `@master` resolves
to today, which is also tagged v1.3.0, so this changes nothing about what
runs now — it just fixes the version in place. The trailing `# v1.3.0`
comment keeps the human-readable version visible for future updates.

This mirrors GitHub's own hardening guidance for third-party actions.

2026-07-14 10:53:57 +03:00

..

ci.yaml

ci: pin ad-m/github-push-action to a full commit SHA

2026-07-14 10:53:57 +03:00