[polewskm]

Why

CodeQL's extended query suite, now on for every NCodeGroup repository, reports a third-party action referenced by a tag as actions/unpinned-tag: whoever controls that repository can move the tag, and the step runs with this workflow's token and secrets. A full commit SHA is the one reference nobody can move.

Changes

Third-party actions are pinned to the commit SHA of the release their tag pointed at, with the release in a comment, so Dependabot's github-actions updates keep bumping them (it updates the SHA and the comment together). Behavior is unchanged: each SHA is the commit the tag resolves to today.

Verified

Each SHA was resolved from the tag with gh api repos/<action>/commits/<tag> and matched to the release tag with git ls-remote --tags. The CodeQL alerts for these lines close when this merges.

🤖 Generated with Claude Code

[ncode-review]

🤖 Review complete

Verdict: ✅ Approve — No findings.

3 reviewers run — 0 findings (run details)

Reviewer	Model	Findings	Top
conventions	sonnet-5-5	0	🟢
hygiene	haiku-5-5	0	🟢
rule-check	sonnet-5-5	0	🟢

Skipped: api-compat, architecture, completeness, correctness, data-model, infrastructure, intent, performance, security, tests

_{Trial: findings are posted as review threads and in the check run. $0.16 on Amazon Bedrock, 31s, at d808a4d. (how to interact)}