[thatguywob]

Pin all 12 external GitHub Actions and reusable workflow references to full commit SHAs. Each SHA was resolved through the GitHub commits API from the existing tag or branch; comments preserve those references for maintenance.

Closes #195

Validation:

• Audited every workflow uses: entry: all external references use 40-character commit SHAs.
• git diff --check and both schema-copy comparisons passed.
• Required Clippy, unit tests, and release build were attempted but could not run because cargo is not installed in this environment. No application code changed.

— hive: backend=codex model=gpt-6.1-sol

---

🐝 Hive Agent: contributor | SHA: 7d89b71

[hanthor-hive-agent]

7d89b71

⚠️ Sentinel alert — maintainer review required

Hive flagged this PR (author @thatguywob, head 7d89b71f08de) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 5 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/ci.yml
  • .github/workflows/flatpak.yml
  • .github/workflows/publish-flatpak.yml
  • .github/workflows/screenshots.yml
  • .github/workflows/ste.yml

Hive added the sentinel-alert label. While it is present, Hive will not approve this PR, apply LGTM/approval labels, or merge it through any auto-merge lane. Remove the label once reviewed; Hive will not re-apply it unless new commits are pushed. Tune paths and behaviors under sentinel in hive.yaml or the dashboard Security tab.

[hanthor]

Sentinel reviewed (hanthor): the diff is benign (it pins third-party actions to verified release SHAs). It duplicates #232, which I've rebased and am landing. Two changes are not taken:

• Org reusable workflows (tuna-os/.github/...@main) stay on @main. tuna-os/.github docs/WORKFLOWS.md says to pin @main and let the org own versioning, and the SHA here was already one commit behind, missing the publish-flatpak generator-verification fix (fix(publish-flatpak): pin and verify flatpak-cargo-generator .github#346).

Closing as a duplicate. Thank you!

[hanthor]

Maintainer decision (supersedes my earlier @main rationale): cross-repository workflows/actions must use immutable full commit SHAs under the newer enforced org policy (.github#288/#335); the same-repository exemption does not apply to dualcut calling tuna-os/.github. The WORKFLOWS.md @main guidance I previously cited was stale and is being corrected centrally. Sorry for the conflicting guidance.

One corrective PR, #250, now pins both org reusable workflows to the centrally reviewed fded0603d7e383990e8259141419fe6c1d641f41 snapshot. Existing permissions, inputs and token mappings are unchanged. Full workflow-pin tests (29), the actual checker against all dualcut workflows, and actionlint on both changed files passed. Merge still requires green CI. The original duplicate/obsolete PRs remain closed; #250 is the single implementation path.