From 362a8ecb8d241a888b9ff6eef5960f77c632886e Mon Sep 17 00:00:00 2001
From: Tobias Wennergren <tobias@airbyte.io>
Date: Wed, 24 Sep 2025 11:48:35 -0700
Subject: [PATCH 1/6] feat: pin sha for github actions

---
 .github/workflows/actionlint.yml              |  4 +-
 .github/workflows/auto_merge_notification.yml |  4 +-
 .github/workflows/autofix.yml                 |  8 ++--
 .github/workflows/fix-pr-command.yml          | 20 ++++-----
 .github/workflows/poetry-lock-command.yml     | 20 ++++-----
 .github/workflows/pydoc_preview.yml           |  8 ++--
 .github/workflows/pydoc_publish.yml           | 12 ++---
 .github/workflows/pypi_publish.yml            | 10 ++---
 .github/workflows/python_lint.yml             | 22 +++++-----
 .github/workflows/python_pytest.yml           | 44 +++++++++----------
 .github/workflows/release_drafter.yml         |  2 +-
 .github/workflows/semantic_pr_check.yml       |  4 +-
 .github/workflows/slash_command_dispatch.yml  |  6 +--
 .github/workflows/test-pr-command.yml         | 22 +++++-----
 .github/workflows/welcome-message.yml         |  8 ++--
 15 files changed, 97 insertions(+), 97 deletions(-)

diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 0449fd19d..a0489a5a5 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -15,9 +15,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
       - name: Run actionlint
-        uses: reviewdog/action-actionlint@v1.67.0
+        uses: reviewdog/action-actionlint@95395aac8c053577d0bc67eb7b74936c660c6f66 # v1.67.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           reporter: github-pr-review
diff --git a/.github/workflows/auto_merge_notification.yml b/.github/workflows/auto_merge_notification.yml
index 239d86552..a0105eb6f 100644
--- a/.github/workflows/auto_merge_notification.yml
+++ b/.github/workflows/auto_merge_notification.yml
@@ -14,7 +14,7 @@ jobs:
     steps:
       - name: Add Auto-Merge Notice
         if: github.event.action == 'auto_merge_enabled'
-        uses: bcgov/action-pr-description-add@v2.0.0
+        uses: bcgov/action-pr-description-add@14338bfe0278ead273b3c1189e5aa286ff6709c4 # v2.0.0
         with:
           add_markdown: |
             > [!IMPORTANT]
@@ -24,7 +24,7 @@ jobs:
 
       - name: Remove Auto-Merge Notice
         if: github.event.action == 'auto_merge_disabled'
-        uses: bcgov/action-pr-description-add@v2.0.0
+        uses: bcgov/action-pr-description-add@14338bfe0278ead273b3c1189e5aa286ff6709c4 # v2.0.0
         with:
           add_markdown: |
             > [!NOTE]
diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
index 06f3ae813..23ad05718 100644
--- a/.github/workflows/autofix.yml
+++ b/.github/workflows/autofix.yml
@@ -13,13 +13,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: 3.10
     - name: Set up Poetry
-      uses: Gr1N/setup-poetry@v9
+      uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       with:
         poetry-version: "2.2.0"
 
@@ -37,6 +37,6 @@ jobs:
         git diff-index --quiet HEAD || git commit -m "Format code with black"
 
     - name: Push changes
-      uses: ad-m/github-push-action@master
+      uses: ad-m/github-push-action@77c5b412c50b723d2a4fbc6d71fb5723bcd439aa # v1.0.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/fix-pr-command.yml b/.github/workflows/fix-pr-command.yml
index 36e099d66..9ac14f93f 100644
--- a/.github/workflows/fix-pr-command.yml
+++ b/.github/workflows/fix-pr-command.yml
@@ -36,7 +36,7 @@ jobs:
 
     # Custom steps to fetch the PR and checkout the code:
     - name: Authenticate as GitHub App
-      uses: actions/create-github-app-token@v2
+      uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
       id: get-app-token
       with:
         owner: "airbytehq"
@@ -44,24 +44,24 @@ jobs:
         app-id: ${{ secrets.OCTAVIA_BOT_APP_ID }}
         private-key: ${{ secrets.OCTAVIA_BOT_PRIVATE_KEY }}
     - name: Checkout Airbyte
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         # Important that this is set so that CI checks are triggered again
         # Without this we would be forever waiting on required checks to pass
         token: ${{ steps.get-app-token.outputs.token }}
 
     - name: Checkout PR (${{ github.event.inputs.pr }})
-      uses: dawidd6/action-checkout-pr@v1
+      uses: dawidd6/action-checkout-pr@a7598e18433a763b784f17d666372913d8bd4205 # v1.2.0
       with:
         pr: ${{ github.event.inputs.pr }}
 
     - name: Resolve workflow variables
       id: vars
-      uses: aaronsteers/resolve-ci-vars-action@v0
+      uses: aaronsteers/resolve-ci-vars-action@2e56afab0344bbe03c047dfa39bae559d0291472 # v0.1.6
 
     - name: Append comment with job run link
       id: first-comment-action
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       with:
         comment-id: ${{ github.event.inputs.comment-id }}
         issue-number: ${{ github.event.inputs.pr }}
@@ -77,11 +77,11 @@ jobs:
           [1]: ${{ steps.vars.outputs.run-url }}
 
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: ${{ matrix.python-version }}
     - name: Set up Poetry
-      uses: Gr1N/setup-poetry@v9
+      uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       with:
         poetry-version: "2.2.0"
     - name: Install dependencies
@@ -150,7 +150,7 @@ jobs:
         git push contributor HEAD:${{ steps.vars.outputs.pr-source-git-branch }}
 
     - name: Append success comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       if: steps.git-diff.outputs.changes == 'true' || steps.git-diff-2.outputs.changes == 'true'
       with:
         comment-id: ${{ steps.first-comment-action.outputs.comment-id }}
@@ -159,7 +159,7 @@ jobs:
           > ✅ Changes applied successfully.
 
     - name: Append success comment (no-op)
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       if: steps.git-diff.outputs.changes != 'true' && steps.git-diff-2.outputs.changes != 'true'
       with:
         comment-id: ${{ steps.first-comment-action.outputs.comment-id }}
@@ -168,7 +168,7 @@ jobs:
           > 🟦 Job completed successfully (no changes).
 
     - name: Append failure comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       if: failure()
       with:
         comment-id: ${{ steps.first-comment-action.outputs.comment-id }}
diff --git a/.github/workflows/poetry-lock-command.yml b/.github/workflows/poetry-lock-command.yml
index 864082605..349e33bb5 100644
--- a/.github/workflows/poetry-lock-command.yml
+++ b/.github/workflows/poetry-lock-command.yml
@@ -33,7 +33,7 @@ jobs:
 
     # Custom steps to fetch the PR and checkout the code:
     - name: Authenticate as GitHub App
-      uses: actions/create-github-app-token@v2
+      uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
       id: get-app-token
       with:
         owner: "airbytehq"
@@ -41,14 +41,14 @@ jobs:
         app-id: ${{ secrets.OCTAVIA_BOT_APP_ID }}
         private-key: ${{ secrets.OCTAVIA_BOT_PRIVATE_KEY }}
     - name: Checkout Airbyte
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         # Important that this is set so that CI checks are triggered again
         # Without this we would be forever waiting on required checks to pass
         token: ${{ steps.get-app-token.outputs.token }}
 
     - name: Checkout PR (${{ github.event.inputs.pr }})
-      uses: dawidd6/action-checkout-pr@v1
+      uses: dawidd6/action-checkout-pr@a7598e18433a763b784f17d666372913d8bd4205 # v1.2.0
       with:
         pr: ${{ github.event.inputs.pr }}
 
@@ -65,11 +65,11 @@ jobs:
 
     - name: Resolve workflow variables
       id: vars
-      uses: aaronsteers/resolve-ci-vars-action@v0
+      uses: aaronsteers/resolve-ci-vars-action@2e56afab0344bbe03c047dfa39bae559d0291472 # v0.1.6
 
     - name: Append comment with job run link
       id: first-comment-action
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       with:
         comment-id: ${{ github.event.inputs.comment-id }}
         issue-number: ${{ github.event.inputs.pr }}
@@ -80,11 +80,11 @@ jobs:
           [1]: ${{ steps.vars.outputs.run-url }}
 
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: ${{ matrix.python-version }}
     - name: Set up Poetry
-      uses: Gr1N/setup-poetry@v9
+      uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       with:
         poetry-version: "2.2.0"
 
@@ -118,7 +118,7 @@ jobs:
         git push contributor HEAD:${{ steps.vars.outputs.pr-source-git-branch }}
 
     - name: Append success comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       if: steps.git-diff.outputs.changes == 'true'
       with:
         comment-id: ${{ steps.first-comment-action.outputs.comment-id }}
@@ -127,7 +127,7 @@ jobs:
           > ✅ `poetry lock` applied successfully.
 
     - name: Append success comment (no-op)
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       if: steps.git-diff.outputs.changes != 'true' && steps.git-diff-2.outputs.changes != 'true'
       with:
         comment-id: ${{ steps.first-comment-action.outputs.comment-id }}
@@ -136,7 +136,7 @@ jobs:
           > 🟦 Job completed successfully (no changes).
 
     - name: Append failure comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       if: failure()
       with:
         comment-id: ${{ steps.first-comment-action.outputs.comment-id }}
diff --git a/.github/workflows/pydoc_preview.yml b/.github/workflows/pydoc_preview.yml
index 1ecc60b25..53fb3d596 100644
--- a/.github/workflows/pydoc_preview.yml
+++ b/.github/workflows/pydoc_preview.yml
@@ -15,13 +15,13 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: '3.10'
     - name: Set up Poetry
-      uses: Gr1N/setup-poetry@v9
+      uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       with:
         poetry-version: "2.2.0"
 
@@ -33,7 +33,7 @@ jobs:
         poetry run poe docs-generate
 
     - name: Upload artifact
-      uses: actions/upload-pages-artifact@v4
+      uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
       with:
         # Upload entire repository
         path: 'docs/generated'
diff --git a/.github/workflows/pydoc_publish.yml b/.github/workflows/pydoc_publish.yml
index 3f971848c..7c8f6dfd8 100644
--- a/.github/workflows/pydoc_publish.yml
+++ b/.github/workflows/pydoc_publish.yml
@@ -32,17 +32,17 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: '3.10'
     - name: Set up Poetry
-      uses: Gr1N/setup-poetry@v9
+      uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       with:
         poetry-version: "2.2.0"
     - name: Setup Pages
-      uses: actions/configure-pages@v5
+      uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
 
     - name: Install dependencies
       run: poetry install
@@ -52,11 +52,11 @@ jobs:
         poetry run poe docs-generate
 
     - name: Upload artifact
-      uses: actions/upload-pages-artifact@v4
+      uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
       with:
         # Upload entire repository
         path: 'docs/generated'
 
     - name: Deploy to GitHub Pages
       id: deployment
-      uses: actions/deploy-pages@v4
+      uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
diff --git a/.github/workflows/pypi_publish.yml b/.github/workflows/pypi_publish.yml
index 758f2656b..6830116ab 100644
--- a/.github/workflows/pypi_publish.yml
+++ b/.github/workflows/pypi_publish.yml
@@ -12,10 +12,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         fetch-depth: 0
-    - uses: hynek/build-and-inspect-python-package@v2
+    - uses: hynek/build-and-inspect-python-package@c52c3a4710070b50470d903818a7b25115dcd076 # v2.13.0
 
   publish:
     name: Publish to PyPI
@@ -29,12 +29,12 @@ jobs:
       url: https://pypi.org/p/airbyte
     if: startsWith(github.ref, 'refs/tags/')
     steps:
-    - uses: actions/download-artifact@v4
+    - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: Packages
         path: dist
     - name: Upload wheel to release
-      uses: svenstaro/upload-release-action@v2
+      uses: svenstaro/upload-release-action@81c65b7cd4de9b2570615ce3aad67a41de5b1a13 # latest
       with:
         repo_token: ${{ secrets.GITHUB_TOKEN }}
         file: dist/*.whl
@@ -43,4 +43,4 @@ jobs:
         file_glob: true
 
     - name: Publish
-      uses: pypa/gh-action-pypi-publish@v1.13.0
+      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
diff --git a/.github/workflows/python_lint.yml b/.github/workflows/python_lint.yml
index cf0febcb1..88a651c7d 100644
--- a/.github/workflows/python_lint.yml
+++ b/.github/workflows/python_lint.yml
@@ -16,17 +16,17 @@ jobs:
     steps:
     # Common steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Set up Poetry
-      uses: Gr1N/setup-poetry@v9
+      uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       with:
         poetry-version: "2.2.0"
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: '3.10'
     - name: Set up Poetry
-      uses: Gr1N/setup-poetry@v9
+      uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       with:
         poetry-version: "2.2.0"
     - name: Install dependencies
@@ -42,13 +42,13 @@ jobs:
     steps:
     # Common steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: '3.10'
     - name: Set up Poetry
-      uses: Gr1N/setup-poetry@v9
+      uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       with:
         poetry-version: "2.2.0"
     - name: Install dependencies
@@ -64,17 +64,17 @@ jobs:
     steps:
     # Common steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Set up Poetry
-      uses: Gr1N/setup-poetry@v9
+      uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       with:
         poetry-version: "2.2.0"
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: '3.10'
     - name: Set up Poetry
-      uses: Gr1N/setup-poetry@v9
+      uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       with:
         poetry-version: "2.2.0"
     - name: Install dependencies
diff --git a/.github/workflows/python_pytest.yml b/.github/workflows/python_pytest.yml
index a6fe4518f..d26df6b4b 100644
--- a/.github/workflows/python_pytest.yml
+++ b/.github/workflows/python_pytest.yml
@@ -26,17 +26,17 @@ jobs:
     steps:
     # Common steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Set up Poetry
-      uses: Gr1N/setup-poetry@v9
+      uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       with:
         poetry-version: "2.2.0"
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: '3.10'
     - name: Set up Poetry
-      uses: Gr1N/setup-poetry@v9
+      uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       with:
         poetry-version: "2.2.0"
     - name: Install dependencies
@@ -63,20 +63,20 @@ jobs:
 
     - name: Upload coverage to GitHub Artifacts
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: fasttest-coverage
         path: htmlcov/
 
     - name: Upload logs to GitHub Artifacts
       if: failure()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: pytest-fast-test-logs
         path: /tmp/airbyte/logs/
 
     - name: Publish Test Results
-      uses: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@3a74b2957438d0b6e2e61d67b05318aa25c9e6c6 # v2.20.0
       if: always() && !cancelled()
       continue-on-error: true
       with:
@@ -91,17 +91,17 @@ jobs:
     steps:
     # Common steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Set up Poetry
-      uses: Gr1N/setup-poetry@v9
+      uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       with:
         poetry-version: "2.2.0"
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: '3.10'
     - name: Set up Poetry
-      uses: Gr1N/setup-poetry@v9
+      uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       with:
         poetry-version: "2.2.0"
     - name: Install dependencies
@@ -130,14 +130,14 @@ jobs:
 
     - name: Upload coverage to GitHub Artifacts
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: nocreds-test-coverage
         path: htmlcov/
 
     - name: Upload logs to GitHub Artifacts
       if: failure()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: pytest-no-creds-test-logs
         path: /tmp/airbyte/logs/
@@ -169,13 +169,13 @@ jobs:
     steps:
     # Common steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: ${{ matrix.python-version }}
     - name: Set up Poetry
-      uses: Gr1N/setup-poetry@v9
+      uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       with:
         poetry-version: "2.2.0"
     - name: Install dependencies
@@ -215,20 +215,20 @@ jobs:
 
     - name: Upload coverage to GitHub Artifacts
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: py${{ matrix.python-version }}-${{ matrix.os }}-test-coverage
         path: htmlcov/
 
     - name: Upload logs to GitHub Artifacts
       if: failure()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: py${{ matrix.python-version }}-${{ matrix.os }}-test-logs
         path: /tmp/airbyte/logs/
 
     - name: Publish Test Results
-      uses: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@3a74b2957438d0b6e2e61d67b05318aa25c9e6c6 # v2.20.0
       if: always() && !cancelled() && matrix.python-version == '3.10' && matrix.os == 'Ubuntu'
       continue-on-error: true
       with:
@@ -242,13 +242,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: '3.10'
     - name: Set up Poetry
-      uses: Gr1N/setup-poetry@v9
+      uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       with:
         poetry-version: "2.2.0"
     - name: Install dependencies
diff --git a/.github/workflows/release_drafter.yml b/.github/workflows/release_drafter.yml
index ea236d5c5..f69330b38 100644
--- a/.github/workflows/release_drafter.yml
+++ b/.github/workflows/release_drafter.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Drafts the next Release notes as Pull Requests are merged into "main"
-      - uses: release-drafter/release-drafter@v6
+      - uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
         with:
           config-name: release-drafter.yml
           disable-autolabeler: true
diff --git a/.github/workflows/semantic_pr_check.yml b/.github/workflows/semantic_pr_check.yml
index 3ef155cc8..44eaa6082 100644
--- a/.github/workflows/semantic_pr_check.yml
+++ b/.github/workflows/semantic_pr_check.yml
@@ -19,7 +19,7 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v6
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         if: ${{ github.event.pull_request.draft == false }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -50,7 +50,7 @@ jobs:
 
       - name: Check for "do not merge" in PR title
         if: ${{ github.event.pull_request.draft == false }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const title = context.payload.pull_request.title.toLowerCase();
diff --git a/.github/workflows/slash_command_dispatch.yml b/.github/workflows/slash_command_dispatch.yml
index f55e0de6d..5209d9a52 100644
--- a/.github/workflows/slash_command_dispatch.yml
+++ b/.github/workflows/slash_command_dispatch.yml
@@ -15,7 +15,7 @@ jobs:
     steps:
 
       - name: Authenticate as GitHub App
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
         id: get-app-token
         with:
           owner: "airbytehq"
@@ -24,7 +24,7 @@ jobs:
           private-key: ${{ secrets.OCTAVIA_BOT_PRIVATE_KEY }}
       - name: Slash Command Dispatch
         id: dispatch
-        uses: peter-evans/slash-command-dispatch@v4
+        uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4.0.0
         with:
           repository: ${{ github.repository }}
           token: ${{ steps.get-app-token.outputs.token }}
@@ -43,7 +43,7 @@ jobs:
 
       - name: Edit comment with error message
         if: steps.dispatch.outputs.error-message
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
         with:
           comment-id: ${{ github.event.comment.id }}
           body: |
diff --git a/.github/workflows/test-pr-command.yml b/.github/workflows/test-pr-command.yml
index 9d8c630bc..8d7936d94 100644
--- a/.github/workflows/test-pr-command.yml
+++ b/.github/workflows/test-pr-command.yml
@@ -31,11 +31,11 @@ jobs:
 
     - name: Resolve workflow variables
       id: vars
-      uses: aaronsteers/resolve-ci-vars-action@v0
+      uses: aaronsteers/resolve-ci-vars-action@2e56afab0344bbe03c047dfa39bae559d0291472 # v0.1.6
 
     - name: Append comment with job run link
       id: first-comment-action
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       with:
         comment-id: ${{ github.event.inputs.comment-id }}
         issue-number: ${{ github.event.inputs.pr }}
@@ -77,7 +77,7 @@ jobs:
     steps:
 
     - name: Authenticate as GitHub App
-      uses: actions/create-github-app-token@v2
+      uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
       id: get-app-token
       with:
         owner: "airbytehq"
@@ -86,7 +86,7 @@ jobs:
         private-key: ${{ secrets.OCTAVIA_BOT_PRIVATE_KEY }}
 
     - name: Checkout PR
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         ref: ${{ needs.start-workflow.outputs.commit-sha }}
@@ -96,7 +96,7 @@ jobs:
     # update the PR checks status.
     - name: Create "Pending" Check Status
       if: always() && !cancelled()
-      uses: LouisBrunner/checks-action@v2.0.0
+      uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       with:
         name: "Pytest (All, Python ${{ matrix.python-version }}, ${{ matrix.os }})"
         repo: "airbytehq/PyAirbyte"  # Post to the main repo, not the fork
@@ -109,11 +109,11 @@ jobs:
     # Same as the `python_pytest.yml` file:
 
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: ${{ matrix.python-version }}
     - name: Set up Poetry
-      uses: Gr1N/setup-poetry@v9
+      uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
       with:
         poetry-version: "2.2.0"
     - name: Install dependencies
@@ -131,7 +131,7 @@ jobs:
         -m "not super_slow and not flaky"
 
     - name: Publish Test Results
-      uses: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@3a74b2957438d0b6e2e61d67b05318aa25c9e6c6 # v2.20.0
       if: always() && !cancelled()
       continue-on-error: true
       with:
@@ -145,7 +145,7 @@ jobs:
     # update the PR checks status.
     - name: Create Final Check Status
       if: always()
-      uses: LouisBrunner/checks-action@v2.0.0
+      uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
       with:
         name: "Pytest (All, Python ${{ matrix.python-version }}, ${{ matrix.os }})"
         repo: "airbytehq/PyAirbyte"  # Post to the main repo, not the fork
@@ -162,7 +162,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Append success comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       with:
         issue-number: ${{ github.event.inputs.pr }}
         comment-id: ${{ github.event.inputs.comment-id }}
@@ -178,7 +178,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Append failure comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
       with:
         issue-number: ${{ github.event.inputs.pr }}
         comment-id: ${{ github.event.inputs.comment-id }}
diff --git a/.github/workflows/welcome-message.yml b/.github/workflows/welcome-message.yml
index f0b500acb..6128ea5bf 100644
--- a/.github/workflows/welcome-message.yml
+++ b/.github/workflows/welcome-message.yml
@@ -27,15 +27,15 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Resolve workflow variables
         id: vars
-        uses: aaronsteers/resolve-ci-vars-action@v0
+        uses: aaronsteers/resolve-ci-vars-action@2e56afab0344bbe03c047dfa39bae559d0291472 # v0.1.6
 
       - name: Render template
         id: template
-        uses: chuhlomin/render-template@v1.10
+        uses: chuhlomin/render-template@807354a04d9300c9c2ac177c0aa41556c92b3f75 # v1.10
         with:
           # Use a different template for internal vs forks (community)
           template: ${{ steps.vars.outputs.pr-source-is-fork == 'true' && '.github/pr-welcome-community.md' || '.github/pr-welcome-internal.md' }}
@@ -44,7 +44,7 @@ jobs:
             branch_name: ${{ steps.vars.outputs.pr-source-git-branch }}
 
       - name: Create comment
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
         with:
           issue-number: ${{ github.event.pull_request.number }}
           body: ${{ steps.template.outputs.result }}

From 9df63fc86d1e2c402c3aa2f46fdad6b7711417ff Mon Sep 17 00:00:00 2001
From: "Aaron (\"AJ\") Steers" <aj@airbyte.io>
Date: Wed, 24 Sep 2025 12:06:19 -0700
Subject: [PATCH 2/6] Apply suggestion from @aaronsteers

---
 .github/workflows/poetry-lock-command.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/poetry-lock-command.yml b/.github/workflows/poetry-lock-command.yml
index 349e33bb5..25107d18b 100644
--- a/.github/workflows/poetry-lock-command.yml
+++ b/.github/workflows/poetry-lock-command.yml
@@ -128,7 +128,7 @@ jobs:
 
     - name: Append success comment (no-op)
       uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
-      if: steps.git-diff.outputs.changes != 'true' && steps.git-diff-2.outputs.changes != 'true'
+      if: steps.git-diff.outputs.changes != 'true'
       with:
         comment-id: ${{ steps.first-comment-action.outputs.comment-id }}
         reactions: "+1"

From b83d68e61ef9b6c0ac350bdfc8549ea5252f2d56 Mon Sep 17 00:00:00 2001
From: "Aaron (\"AJ\") Steers" <aj@airbyte.io>
Date: Wed, 24 Sep 2025 12:10:15 -0700
Subject: [PATCH 3/6] docs: add blub to CONTRIBUTING.md

---
 docs/CONTRIBUTING.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index 325af23e9..4223d0f2e 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -65,3 +65,13 @@ Note: If you have pre-installed [Poe](https://poethepoet.natn.io/index.html)
 ## Versioning
 
 Versioning follows [Semantic Versioning](https://semver.org/). For new features, bump the minor version. For bug fixes, bump the patch version. For pre-releases, append `dev.N` to the version. For example, `0.1.0dev.1` is the first pre-release of the `0.1.0` version.
+
+## GitHub Action Workflows
+
+This repo uses a policy of SHA-pinning GitHub Actions, for hardened security.
+
+To pin your GitHub actions, you can use the [pinact](https://github.com/suzuki-shunsuke/pinact) tool:
+
+```bash
+[tk] - bash CLI example here
+```

From 1a0c2305e5a3d6a2557f25c4c255f32a5f1edddb Mon Sep 17 00:00:00 2001
From: Tobias Wennergren <tobias@airbyte.io>
Date: Wed, 24 Sep 2025 12:42:21 -0700
Subject: [PATCH 4/6] added pinact example

---
 docs/CONTRIBUTING.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index 4223d0f2e..dae23f45a 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -73,5 +73,8 @@ This repo uses a policy of SHA-pinning GitHub Actions, for hardened security.
 To pin your GitHub actions, you can use the [pinact](https://github.com/suzuki-shunsuke/pinact) tool:
 
 ```bash
-[tk] - bash CLI example here
+# Convert from from fixed version to sha
+# Example: actions/checkout@v4 -> actions/checkout@08e... # v4.3.0
+pinact run [optional_file]
+
 ```

From 3e67129546160ffe9c0342e94681f8ce7fc994ca Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 24 Sep 2025 20:26:12 +0000
Subject: [PATCH 5/6] feat: add poe-based pinact automation for GitHub Actions
 SHA pinning

- Add required Poe tasks: install, gh-ci-check, gh-ci-fix to pyproject.toml
- Create gh-ci-fix-command.yml workflow using poe-command-processor for slash commands
- Create validate-pinned-actions.yml workflow for CI validation using poe gh-ci-check
- Update slash_command_dispatch.yml to include gh-ci-fix command
- Update CONTRIBUTING.md with comprehensive pinact CLI examples and slash command usage

This implements automated SHA pinning for GitHub Actions using the Poe task runner
and poe-command-processor action, providing both slash command and CI validation.

Co-Authored-By: AJ Steers <aj@airbyte.io>
---
 .github/workflows/gh-ci-fix-command.yml       | 43 ++++++++++++++++
 .github/workflows/slash_command_dispatch.yml  |  1 +
 .github/workflows/validate-pinned-actions.yml | 51 +++++++++++++++++++
 docs/CONTRIBUTING.md                          | 15 ++++--
 pyproject.toml                                |  5 ++
 5 files changed, 112 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/gh-ci-fix-command.yml
 create mode 100644 .github/workflows/validate-pinned-actions.yml

diff --git a/.github/workflows/gh-ci-fix-command.yml b/.github/workflows/gh-ci-fix-command.yml
new file mode 100644
index 000000000..25cf445de
--- /dev/null
+++ b/.github/workflows/gh-ci-fix-command.yml
@@ -0,0 +1,43 @@
+name: On-Demand GitHub Actions Pin Fix
+
+on:
+  workflow_dispatch:
+    inputs:
+      pr:
+        description: 'PR Number'
+        type: string
+        required: true
+      comment-id:
+        description: 'Comment ID (Optional)'
+        type: string
+        required: false
+
+permissions:
+  contents: write
+  workflows: write
+  pull-requests: write
+
+env:
+  AIRBYTE_ANALYTICS_ID: ${{ vars.AIRBYTE_ANALYTICS_ID }}
+
+jobs:
+  gh-ci-fix:
+    name: Pin GitHub Actions
+    runs-on: ubuntu-latest
+    steps:
+      - name: Authenticate as GitHub App
+        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+        id: get-app-token
+        with:
+          owner: "airbytehq"
+          repositories: "PyAirbyte"
+          app-id: ${{ secrets.OCTAVIA_BOT_APP_ID }}
+          private-key: ${{ secrets.OCTAVIA_BOT_PRIVATE_KEY }}
+
+      - name: Run Poe Command
+        uses: aaronsteers/poe-command-processor@v1
+        with:
+          command: "gh-ci-fix"
+          github-token: ${{ steps.get-app-token.outputs.token }}
+          pr: ${{ github.event.inputs.pr }}
+          comment-id: ${{ github.event.inputs.comment-id }}
diff --git a/.github/workflows/slash_command_dispatch.yml b/.github/workflows/slash_command_dispatch.yml
index 5209d9a52..37d49f6f6 100644
--- a/.github/workflows/slash_command_dispatch.yml
+++ b/.github/workflows/slash_command_dispatch.yml
@@ -34,6 +34,7 @@ jobs:
             fix-pr
             test-pr
             poetry-lock
+            gh-ci-fix
           static-args: |
             pr=${{ github.event.issue.number }}
             comment-id=${{ github.event.comment.id }}
diff --git a/.github/workflows/validate-pinned-actions.yml b/.github/workflows/validate-pinned-actions.yml
new file mode 100644
index 000000000..6e41ce84b
--- /dev/null
+++ b/.github/workflows/validate-pinned-actions.yml
@@ -0,0 +1,51 @@
+name: Validate Pinned Actions
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+      - '**/action.yml'
+      - '**/action.yaml'
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  validate-pinned-actions:
+    name: Validate Actions are SHA-pinned
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.10'
+
+      - name: Set up Poetry
+        uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
+        with:
+          poetry-version: "2.2.0"
+
+      - name: Install dependencies
+        run: poetry install
+
+      - name: Install pinact CLI
+        run: |
+          go install github.com/suzuki-shunsuke/pinact/cmd/pinact@latest
+
+      - name: Validate all actions are pinned
+        run: |
+          if ! poetry run poe gh-ci-check; then
+            echo "❌ Some GitHub Actions are not pinned to SHA hashes!"
+            echo ""
+            echo "To fix this, use the slash command '/gh-ci-fix' on this PR."
+            echo ""
+            echo "Or run locally:"
+            echo "  poetry run poe gh-ci-fix"
+            exit 1
+          else
+            echo "✅ All GitHub Actions are properly pinned to SHA hashes."
+          fi
diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index dae23f45a..507d421f2 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -73,8 +73,17 @@ This repo uses a policy of SHA-pinning GitHub Actions, for hardened security.
 To pin your GitHub actions, you can use the [pinact](https://github.com/suzuki-shunsuke/pinact) tool:
 
 ```bash
-# Convert from from fixed version to sha
-# Example: actions/checkout@v4 -> actions/checkout@08e... # v4.3.0
-pinact run [optional_file]
+# Install pinact CLI tool
+go install github.com/suzuki-shunsuke/pinact/cmd/pinact@latest
 
+# Pin all GitHub Actions in workflow files
+pinact run
+
+# Pin actions in a specific file
+pinact run .github/workflows/python_lint.yml
+
+# Check if actions are pinned (dry-run)
+pinact run --dry-run
 ```
+
+You can also use the `/gh-ci-fix` slash command on pull requests to automatically pin actions.
diff --git a/pyproject.toml b/pyproject.toml
index d5e3d2828..d766b7bfc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -199,6 +199,11 @@ fix = { shell = "ruff format . && ruff check --fix -s || ruff format ." }
 fix-unsafe = { shell = "ruff format . && ruff check --fix --unsafe-fixes . && ruff format ." }
 fix-and-check = { shell = "poe fix && poe check" }
 
+# GitHub Actions CI tasks
+install = { shell = "poetry install" }
+gh-ci-check = { shell = "pinact run --dry-run", help = "Check if GitHub Actions are pinned to SHA hashes" }
+gh-ci-fix = { shell = "pinact run", help = "Pin GitHub Actions to their SHA hashes" }
+
 # MCP Server Tasks
 mcp-serve-local = { cmd = "poetry run airbyte-mcp", help = "Start the MCP server with STDIO transport" }
 mcp-serve-http = { cmd = "poetry run python -c \"from airbyte.mcp.server import app; app.run(transport='http', host='127.0.0.1', port=8000)\"", help = "Start the MCP server with HTTP transport" }

From 8f87ad5f51c1884250bd12b1b5377baa40c3ff5a Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 24 Sep 2025 20:29:32 +0000
Subject: [PATCH 6/6] fix: update pinact CLI flags and pin
 poe-command-processor action

- Fix gh-ci-check task to use --check flag instead of --dry-run
- Use full path /home/ubuntu/go/bin/pinact for Poe tasks to ensure accessibility
- Pin aaronsteers/poe-command-processor@v1 to SHA hash for security
- Verify both poe gh-ci-check and poe gh-ci-fix tasks work correctly

Co-Authored-By: AJ Steers <aj@airbyte.io>
---
 .github/workflows/gh-ci-fix-command.yml | 2 +-
 pyproject.toml                          | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/gh-ci-fix-command.yml b/.github/workflows/gh-ci-fix-command.yml
index 25cf445de..0fcd723ba 100644
--- a/.github/workflows/gh-ci-fix-command.yml
+++ b/.github/workflows/gh-ci-fix-command.yml
@@ -35,7 +35,7 @@ jobs:
           private-key: ${{ secrets.OCTAVIA_BOT_PRIVATE_KEY }}
 
       - name: Run Poe Command
-        uses: aaronsteers/poe-command-processor@v1
+        uses: aaronsteers/poe-command-processor@04330aa7047b6b182ff280a962cbbcd99d6eb683 # v1.3.0
         with:
           command: "gh-ci-fix"
           github-token: ${{ steps.get-app-token.outputs.token }}
diff --git a/pyproject.toml b/pyproject.toml
index d766b7bfc..2c160cd05 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -201,8 +201,8 @@ fix-and-check = { shell = "poe fix && poe check" }
 
 # GitHub Actions CI tasks
 install = { shell = "poetry install" }
-gh-ci-check = { shell = "pinact run --dry-run", help = "Check if GitHub Actions are pinned to SHA hashes" }
-gh-ci-fix = { shell = "pinact run", help = "Pin GitHub Actions to their SHA hashes" }
+gh-ci-check = { shell = "$HOME/go/bin/pinact run --check", help = "Check if GitHub Actions are pinned to SHA hashes" }
+gh-ci-fix = { shell = "$HOME/go/bin/pinact run", help = "Pin GitHub Actions to their SHA hashes" }
 
 # MCP Server Tasks
 mcp-serve-local = { cmd = "poetry run airbyte-mcp", help = "Start the MCP server with STDIO transport" }