From 696fe4c3ecdba391286c0fc260cf86165710c167 Mon Sep 17 00:00:00 2001
From: Matthew Berman <748450+mberman84@users.noreply.github.com>
Date: Sat, 20 Jun 2026 17:14:42 -0700
Subject: [PATCH] Update checkout action runtime pin

---
 .github/workflows/ci.yml     |  2 +-
 examples/github-workflow.yml |  2 +-
 tests/test_skill.py          | 10 ++++++++++
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e6b906e..9ed766a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,7 +15,7 @@ jobs:
       matrix:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
         with:
           python-version: ${{ matrix.python-version }}
diff --git a/examples/github-workflow.yml b/examples/github-workflow.yml
index 7bfaa37..fe9b7ad 100644
--- a/examples/github-workflow.yml
+++ b/examples/github-workflow.yml
@@ -33,7 +33,7 @@ jobs:
       github.event.label.name == 'merge-queue'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false
diff --git a/tests/test_skill.py b/tests/test_skill.py
index 3de369e..a85645f 100644
--- a/tests/test_skill.py
+++ b/tests/test_skill.py
@@ -7,6 +7,7 @@
 ROOT = Path(__file__).resolve().parents[1]
 CANONICAL = ROOT / "skills" / "deploybot" / "SKILL.md"
 RELEASE_COMMIT = "2e884f65f182f6a9ddc4c4785288045bdf98f188"
+CHECKOUT_COMMIT = "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"
 
 
 class DeployBotSkillTest(unittest.TestCase):
@@ -56,6 +57,15 @@ def test_github_workflow_wakes_after_named_ci_finishes(self) -> None:
         self.assertIn("github.event.repository.default_branch", workflow)
         self.assertIn("persist-credentials: false", workflow)
 
+    def test_workflows_pin_current_checkout_runtime(self) -> None:
+        paths = [
+            ROOT / ".github" / "workflows" / "ci.yml",
+            ROOT / "examples" / "github-workflow.yml",
+        ]
+        for path in paths:
+            with self.subTest(path=path):
+                self.assertIn(CHECKOUT_COMMIT, path.read_text(encoding="utf-8"))
+
     def test_clients_pin_the_immutable_status_release(self) -> None:
         paths = [
             ROOT / "adapters" / "codex" / "agent-merge-queue" / ".mcp.json",