From 2f05d70bdad6a2c92c67676d2bd94824ba2476da Mon Sep 17 00:00:00 2001
From: defangdevs <defangdevs@users.noreply.github.com>
Date: Wed, 26 Aug 2026 10:27:52 -0700
Subject: [PATCH 1/2] ci: bump actions/checkout to v5 to fix Node 20
 deprecation warning

---
 .github/workflows/release.yaml | 2 +-
 .github/workflows/test.yaml    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index a3a50b0..49800fd 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -13,7 +13,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 1 # only the tagged commit is needed
 
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 14bfa73..ca02720 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Deploy
         uses: ./

From 47550be7f529b69f4ea6c2540b12e68474396190 Mon Sep 17 00:00:00 2001
From: defangdevs <defangdevs@users.noreply.github.com>
Date: Tue, 8 Sep 2026 16:06:08 -0700
Subject: [PATCH 2/2] ci: pin actions/checkout to full SHA per CodeRabbit
 review

Addresses coderabbitai review on PR #60: pin actions/checkout@v5 to its
commit SHA (matching the pinning style already used for
dependabot/fetch-metadata), and set persist-credentials: false on the
read-only test workflow checkout.
---
 .github/workflows/release.yaml | 2 +-
 .github/workflows/test.yaml    | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 49800fd..1a6d43d 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -13,7 +13,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           fetch-depth: 1 # only the tagged commit is needed
 
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index ca02720..5fb111e 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -18,7 +18,9 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Deploy
         uses: ./