From 7c29a88f380ec7a5a1104ba6252b6fbb51439cd2 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 19 Sep 2026 23:03:47 +0000
Subject: [PATCH] fix(ci): pin third-party actions to full commit SHAs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at
startup — `startup_failure`, no jobs, "this workflow graph cannot be shown" — so these workflows
could not run at all. This resolves each ref to the commit it currently points at and records the
ref in a trailing comment, e.g. `actions/checkout@<sha> # v4`.

`dtolnay/rust-toolchain` takes its toolchain from the ref itself, so those steps also gained an
explicit `with: toolchain:` input; without it, a SHA ref would silently lose the channel.

No behaviour is intended to change beyond the pins.
---
 .github/workflows/comprehensive-quality.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/comprehensive-quality.yml b/.github/workflows/comprehensive-quality.yml
index dafb32d..74000fa 100644
--- a/.github/workflows/comprehensive-quality.yml
+++ b/.github/workflows/comprehensive-quality.yml
@@ -52,7 +52,7 @@ jobs:
             pip install safety && safety check -r requirements.txt || true
           fi
       - name: SAST scan
-        uses: returntocorp/semgrep-action@v1
+        uses: returntocorp/semgrep-action@713efdd345f3035192eaa63f56867b88e63e4e5d  # v1
         continue-on-error: true
 
   # INTEROPERABILITY - API and format compatibility