[justinbanon-agent]

What this does

Pins 2 third-party action references in 2 files to the exact commit each tag points to today, with the version in a comment. This is option 2 from bosonprotocol/core-components#1046.

• No behaviour change: each SHA is the commit the tag or branch resolves to today, so the runs use the same code as now.
• Why: a tag such as @v4 can be moved by its publisher; a commit SHA cannot. That is what happened with tj-actions/changed-files in March 2025.
• Where the SHAs come from: the upstream repository's own tags (annotated tags resolved to the commit, not the tag object).

Pinned

File	Line	Was	Now	Version
.github/workflows/deploy-preview.yaml	40	marocchino/sticky-pull-request-comment@v2	marocchino/sticky-pull-request-comment@7737449	v2.9.4
.github/workflows/deploy_reusable.yaml	245	cloudflare/wrangler-action@v3	cloudflare/wrangler-action@9acf94a	v3.15.0

Full SHAs are in the diff.

• marocchino/sticky-pull-request-comment: v2 is a branch; its head is the commit of release tag v2.9.4.

Left as they are

Nothing: every third-party reference in this repo is now pinned.

• For your R5 check: cloudflare/wrangler-action installs a tool at run time (your "check carefully" list in Cheap alternative to #1045: pin third-party actions by SHA and allow those exact SHAs at org level core-components#1046). Pinning freezes the action, not what it installs.

How to check

On this pull request, these workflows start (no "workflow file issue") and pass:

• Deploy PR preview: the sticky preview comment and the Cloudflare deploy (wrangler).

In each job's "Set up job" log, the "Download action repository" lines show the pinned SHAs.

After the merge to main:

• Deploy to testing on main: wrangler.

Once this is green, the organisation's "any version" entries for these actions can be swapped for the exact SHAs, but only for an action that no other repo still uses by tag.

Rollback: revert this merge.

Prepared by Claude for Justin; Ludo reviews and merges. Refs bosonprotocol/core-components#1046.

🤖 Generated with Claude Code

[github-actions]

Preview deployment

Widget	URL
Dev playground	https://33d514d6.boson-widgets-testing.pages.dev/#/dev
Redemption	https://33d514d6.boson-widgets-testing.pages.dev/#/redeem
Finance	https://33d514d6.boson-widgets-testing.pages.dev/#/finance
Embedding example	https://33d514d6.boson-widgets-testing.pages.dev/example.html

Built from 2451a23 against the testing environment.

[Copilot]

🟡 Changes recommended

The code changes are correct and both pinned SHAs were verified against their tags, but it is deployment-pipeline configuration where I'd defer the final merge decision to a human reviewer rather than auto-approve.

No open issues 🎉

What changed in this PR

This PR hardens the CI/CD supply chain by pinning two third-party GitHub Actions to exact commit SHAs instead of mutable tag references, with the human-readable version retained in a trailing comment. This mitigates the risk of a publisher moving a tag to point at malicious code (as happened with tj-actions/changed-files in March 2025). It implements option 2 from bosonprotocol/core-components#1046 and is purely a hardening change with no runtime behavior change.

Changes:

• Pin marocchino/sticky-pull-request-comment@v2 → @773744901bac0e8cbb5a0dc842800d45e9b2b405 (v2.9.4).
• Pin cloudflare/wrangler-action@v3 → @9acf94ace14e7dc412b076f2c5c20b8ce93c79cd (v3.15.0).

File	Description
.github/​workflows/​deploy-preview.yaml	Pins the sticky PR comment action to the verified SHA for v2.9.4.
.github/​workflows/​deploy_reusable.yaml	Pins the Cloudflare wrangler deploy action to the verified SHA for v3.15.0.

_{Review effort: Balanced}