From e3a8f0ba0dd4eb9e268028cf19c2924d75672751 Mon Sep 17 00:00:00 2001
From: Jacek <jacek@clerk.dev>
Date: Fri, 22 May 2026 21:08:46 -0500
Subject: [PATCH] chore: pin GitHub Actions to SHAs and drop persisted tokens

---
 .changeset/harden-gh-actions.md       |  2 ++
 .github/dependabot.yml                | 10 ++++++++++
 .github/workflows/api-check.yml       |  9 +++++----
 .github/workflows/pkg-pr-new.yml      |  7 ++++---
 .github/workflows/publish-preview.yml |  7 ++++---
 .github/workflows/release.yml         | 11 +++++++----
 action.yml                            |  2 +-
 7 files changed, 33 insertions(+), 15 deletions(-)
 create mode 100644 .changeset/harden-gh-actions.md
 create mode 100644 .github/dependabot.yml

diff --git a/.changeset/harden-gh-actions.md b/.changeset/harden-gh-actions.md
new file mode 100644
index 0000000..a845151
--- /dev/null
+++ b/.changeset/harden-gh-actions.md
@@ -0,0 +1,2 @@
+---
+---
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..6c5049e
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/api-check.yml b/.github/workflows/api-check.yml
index 59914ff..1a27839 100644
--- a/.github/workflows/api-check.yml
+++ b/.github/workflows/api-check.yml
@@ -15,13 +15,14 @@ jobs:
   api-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
+          persist-credentials: false
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "24"
           cache: "pnpm"
@@ -51,7 +52,7 @@ jobs:
         continue-on-error: true
 
       - name: Comment on PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/pkg-pr-new.yml b/.github/workflows/pkg-pr-new.yml
index 12fbc9a..f7d7295 100644
--- a/.github/workflows/pkg-pr-new.yml
+++ b/.github/workflows/pkg-pr-new.yml
@@ -14,13 +14,14 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
+          persist-credentials: false
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "24"
           cache: "pnpm"
diff --git a/.github/workflows/publish-preview.yml b/.github/workflows/publish-preview.yml
index da185f9..9b82fab 100644
--- a/.github/workflows/publish-preview.yml
+++ b/.github/workflows/publish-preview.yml
@@ -21,13 +21,14 @@ jobs:
           - "26"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
+          persist-credentials: false
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ matrix.node-version }}
           cache: "pnpm"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7280a38..475498b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,13 +17,16 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      # Persisted credentials are intentionally kept on this checkout so the
+      # subsequent `changesets/action` step can push the Version PR back to
+      # the repo using GITHUB_TOKEN.
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "24"
           cache: "pnpm"
@@ -35,7 +38,7 @@ jobs:
 
       - name: Create release PR or publish
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1
         with:
           publish: pnpm release
           version: pnpm version
diff --git a/action.yml b/action.yml
index 714cacd..29cee73 100644
--- a/action.yml
+++ b/action.yml
@@ -140,7 +140,7 @@ runs:
 
     - name: Comment on PR
       if: inputs.comment == 'true' && github.event_name == 'pull_request'
-      uses: actions/github-script@v7
+      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
       with:
         github-token: ${{ inputs.github-token }}
         script: |