Pin and modernize GitHub Actions references - #194

Draft

jar-stripe wants to merge 14 commits into

jar/sat-28956-pin-workflows

Commits on Aug 14, 2026

Hash-pin action references

jar-stripe
and
claude
committed
f3631df
Bump actions/checkout to v7 across all five sites

jar-stripe
and
claude
committed
70ada0a
Bump peter-evans/create-pull-request v6 -> v8

jar-stripe
and
claude
committed
b511e3b
Bump softprops/action-gh-release v1 -> v3

jar-stripe
and
claude
committed
78157c2
Replace archived tibdex/github-app-token with actions/create-github-app-token

jar-stripe
and
claude
committed
c43760b
Read workflow inputs from env instead of interpolating into run:

jar-stripe
and
claude
committed
afeda3b
Stop actions/checkout persisting credentials where nothing needs them

jar-stripe
and
claude
committed
d47d444
Pass the App token to curl through env, and scope release.yml's permissions

jar-stripe
and
claude
committed
4ecdd59
Create the release with gh instead of softprops/action-gh-release

jar-stripe
and
claude
committed
56a0157
Hash-pin the composite actions' references

jar-stripe
and
claude
committed
7aca846
Replace archived tibdex/github-app-token in actions/approve

jar-stripe
and
claude
committed
b2908bd
Read composite action inputs from env instead of interpolating into run:

jar-stripe
and
claude
committed
aec5c2a
Add zizmor to CI

jar-stripe
and
claude
committed
54bfd3f
Refuse to release from a non-tag ref

jar-stripe
and
claude
committed
559905e