From 9061a4c93bc80cc5dd54a310fae22852f12a778d Mon Sep 17 00:00:00 2001
From: Bob <bob@standardinput.co>
Date: Mon, 24 Aug 2026 19:07:57 -0400
Subject: [PATCH] ci: pin Node 24 release actions

---
 .github/workflows/prepare-release.yml | 4 ++--
 .github/workflows/publish-release.yml | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
index 2e67dc5..746ad8c 100644
--- a/.github/workflows/prepare-release.yml
+++ b/.github/workflows/prepare-release.yml
@@ -10,7 +10,7 @@ jobs:
   assets:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install pinned build tools
@@ -33,7 +33,7 @@ jobs:
           just release-dist "$GITHUB_SHA"
           test "$(find dist -mindepth 1 -maxdepth 1 -type f | wc -l)" -eq 3
           test "$(find dist -mindepth 1 -maxdepth 1 | wc -l)" -eq 3
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-candidate-assets
           path: dist/
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index c1e3f6b..6462b17 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -41,7 +41,7 @@ jobs:
       contents: write
       id-token: write
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Verify dispatch and candidate build identity
@@ -68,7 +68,7 @@ jobs:
             .conclusion == "success" and
             .run_attempt == 1
           ' "$run_json" >/dev/null
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: release-candidate-assets
           path: dist
@@ -184,7 +184,7 @@ jobs:
           test "$(cat "$readback/SHA256SUMS")" = "$PACKAGE_SHA256  $PACKAGE_NAME"
       - name: Create GitHub OIDC build provenance for the exact package
         id: attest
-        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-name: ${{ steps.release.outputs.package_name }}
           subject-digest: ${{ steps.release.outputs.subject_digest }}