[OskarEichler]

Summary

• Pin the checkout and Ruby setup actions to the exact commits currently resolved by @v6 and @v1.
• Keep readable version comments beside each immutable reference.
• Preserve the existing read-only GITHUB_TOKEN permission boundary and CI behavior.

Security impact
GitHub currently resolves both third-party actions through mutable refs. If either ref moves unexpectedly or its upstream repository is compromised, changed action code can execute in Erubi's test jobs without an Erubi commit. The job does not publish packages or declare secrets, and fork pull requests do not receive repository secrets, so I rate this LOW urgency.

Verification

• Confirmed actions/checkout@v6 resolves to d23441a48e516b6c34aea4fa41551a30e30af803.
• Confirmed ruby/setup-ruby@v1 resolves to 95ef2b042f9d7a56d8268cba8559e2842e2ad01b.
• Parsed .github/workflows/ci.yml with Ruby YAML.
• Ran the existing suite on Ruby 4.0.6: 100 runs, 173 assertions, 0 failures.
• Compiled all three packaged Ruby files and ran git diff --check.
• Built the 1.13.1 gem successfully before cleaning the artifact.

Limitations
Hosted CI remains the authoritative check for the full MRI/JRuby/TruffleRuby matrix.

Breaking changes
None. Runtime code and package contents are unchanged.

[jeremyevans]

Same comments as in jeremyevans/tilt#48 (comment) . As an additional problem with this approach, if you pin the commit hash, you don't get updated Ruby patch versions without updating the commit hash, which can prevent detection of regressions in patch versions.