Pin GitHub Actions

[gjtorikian]

Summary

Pin all third-party GitHub Actions to immutable commit SHAs.

Why

Action tags (like v3, v4, main) can be moved or retagged, which means a future workflow run could execute different code than what we reviewed today. Pinning to SHAs makes the workflow supply chain deterministic and auditable, reducing the risk of action-level compromise or accidental breaking changes. We can still update intentionally by bumping the SHA.

[greptile-apps]

Greptile Summary

This PR successfully pins third-party GitHub Actions to immutable commit SHAs across all workflow files, improving supply chain security. However, the PR contains unrelated changes that should be separated:

• GitHub Actions pinning (3 workflow files): All pins are correct with proper version comments
• Claude documentation (~2,500 lines): New .claude/ directory with SDK generation docs - unrelated to Actions pinning
• Bug fix commit (separate author): Fixes revokeSession API endpoint to use POST body instead of URL path - unrelated to Actions pinning

Recommendations:

• The Actions pinning changes are safe and ready to merge
• Consider splitting the Claude documentation and bug fix into separate PRs for cleaner git history and easier review
• The revokeSession fix correctly changes from path parameter to request body, matching API documentation

Confidence Score: 4/5

• Safe to merge - all code changes are correct, but PR contains unrelated changes
• Score reflects that while all technical changes are sound (SHA pinning is correct, bug fix properly addresses API format issue), the PR mixes three unrelated concerns that should be separate PRs, making review and git history less clear
• No files require special attention - all changes are straightforward

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Properly pins actions/checkout and actions/cache to commit SHAs with version comments
.github/workflows/release.yml	Properly pins actions/create-github-app-token, actions/checkout, and softprops/action-gh-release to SHAs
.github/workflows/version-bump.yml	Properly pins actions/create-github-app-token, actions/checkout, and peter-evans/create-pull-request to SHAs
lib/UserManagement.php	Fixes revokeSession API call to use correct endpoint format with session_id in request body
tests/WorkOS/UserManagementTest.php	Updates test to match corrected revokeSession API call format

_{Last reviewed commit: 2115ffc}

[greptile-apps]

_{11 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}