From a78888358073fbc185f833410ba1ac9a1d0ac4f5 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Tue, 20 Oct 2026 08:46:30 -0700
Subject: [PATCH] Pin GitHub Action version comments to exact tags

zizmor's ref-version-mismatch check fails when a hash pin's comment names a
tag that no longer points at the pinned commit. swatinem/rust-cache moved its
`v2` tag to v2.9.3, so `6323deb # v2` (v2.9.2) turned main's Workflow Lint red.
tauri-action and neon create-branch-action carried the same major-only comment
and would break the same way on their next release.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml             | 2 +-
 .github/workflows/hosted-preview.yml | 2 +-
 .github/workflows/release.yml        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d8632acb1..c2a599367 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -400,7 +400,7 @@ jobs:
       # Windows and macOS runners bill at a multiple of Linux, so the dependency
       # compile is cached rather than paid on every PR.
       - name: Rust cache
-        uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+        uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           workspaces: standalone/src-tauri
 
diff --git a/.github/workflows/hosted-preview.yml b/.github/workflows/hosted-preview.yml
index cdab49f47..83fdaded3 100644
--- a/.github/workflows/hosted-preview.yml
+++ b/.github/workflows/hosted-preview.yml
@@ -122,7 +122,7 @@ jobs:
           PREVIEW_AUTH_SECRET: ${{ secrets.PREVIEW_AUTH_SECRET }}
       - name: Create or reuse PR database branch
         id: database
-        uses: neondatabase/create-branch-action@fb620d43d4c565abaf088b848a4e28e5c4ea4d9c # v6
+        uses: neondatabase/create-branch-action@fb620d43d4c565abaf088b848a4e28e5c4ea4d9c # 6.3.1
         with:
           project_id: ${{ vars.NEON_PROJECT_ID }}
           parent_branch: ${{ vars.NEON_PREVIEW_PARENT_BRANCH }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 788ceaec1..4fa75dacf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -89,7 +89,7 @@ jobs:
           echo "TAURI_SIGNING_PRIVATE_KEY=$key_path" >> "$GITHUB_ENV"
 
       - name: Build Tauri app
-        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1
+        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: