From f9993243d9208081f6b72fc31cce0136ce1634b0 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 27 Oct 2026 16:33:55 +0000
Subject: [PATCH 1/2] chore(ci): pin every third-party GitHub Action to a
 commit SHA

Replace the 98 uses: references that floated on a mutable tag with the full
commit of a verified release and the version as a trailing comment, one pin
per action across the workflows and the composite actions. The pins that
already existed move to the same release where they were behind it.

Co-Authored-By: jason.han <hanhuijun@gmail.com>
---
 .github/actions/corpora/action.yml            |  16 +-
 .../extension-libraries-upstream.yml          |   6 +-
 .github/workflows/mcp-registry.yml            |   2 +-
 .github/workflows/nightly.yml                 |  22 +--
 .github/workflows/oracle-reproduction.yml     |   8 +-
 .github/workflows/pages.yml                   |  14 +-
 .github/workflows/pr.yml                      | 142 +++++++++---------
 .github/workflows/release-windows.yml         |  40 ++---
 .github/workflows/syson-artifacts.yml         |   6 +-
 .github/workflows/upstream-drift.yml          |   2 +-
 .github/workflows/validate-action.yml         |   8 +-
 .github/workflows/wasm-cache.yml              |  10 +-
 CONTRIBUTING.md                               |   5 +
 action.yml                                    |   2 +-
 .../unreleased/pin-github-actions.security.md |   1 +
 15 files changed, 145 insertions(+), 139 deletions(-)
 create mode 100644 changes/unreleased/pin-github-actions.security.md

diff --git a/.github/actions/corpora/action.yml b/.github/actions/corpora/action.yml
index e16db1c48c..d12352016c 100644
--- a/.github/actions/corpora/action.yml
+++ b/.github/actions/corpora/action.yml
@@ -17,7 +17,7 @@ runs:
   using: composite
   steps:
     - name: Cache the OMG training corpus
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: examples/sysml-v2-training
         key: training-corpus-${{ hashFiles('scripts/download-training-examples.sh', 'scripts/pilot-pin.sh') }}
@@ -39,7 +39,7 @@ runs:
     # Same keying as the training corpus: the download script plus the shared
     # pilot pin.
     - name: Cache the OMG pilot corpora
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: examples/pilot-corpora
         key: pilot-corpora-${{ hashFiles('scripts/download-pilot-corpora.sh', 'scripts/pilot-pin.sh') }}
@@ -64,7 +64,7 @@ runs:
     # the PDFs are cached, the extraction reruns from them (it is the tree's
     # own tool), and the result is verified rather than trusted.
     - name: Cache the OMG specification documents
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: build/spec-docs/pdf
         key: spec-docs-${{ hashFiles('scripts/download-spec-examples.sh', 'scripts/pilot-pin.sh') }}
@@ -89,7 +89,7 @@ runs:
 
     # The PSSM suite is one pinned file; keyed on its download script and pin.
     - name: Cache the OMG PSSM test suite
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: build/pssm
         key: pssm-suite-${{ hashFiles('scripts/download-pssm-suite.sh', 'scripts/pssm-pin.sh') }}
@@ -101,7 +101,7 @@ runs:
     # The SysML v1 to v2 transformation model is one pinned file; keyed on its
     # download script and pin.
     - name: Cache the SysML v1 to v2 transformation model
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: build/sysml-v1tov2
         key: sysml-v1tov2-${{ hashFiles('scripts/download-sysml-v1tov2.sh', 'scripts/sysml-v1tov2-pin.sh') }}
@@ -114,7 +114,7 @@ runs:
     # on its download script and pin. Never run in CI: the Go tests read the
     # committed expected-record (docs/project/fuml-referee.md).
     - name: Cache the fUML reference-implementation suite
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: build/fuml
         key: fuml-suite-${{ hashFiles('scripts/download-fuml-suite.sh', 'scripts/fuml-pin.sh') }}
@@ -126,7 +126,7 @@ runs:
     # The pilot's XMI of the standard library, one subtree of the release
     # repository; keyed on its download script and the shared pilot pin.
     - name: Cache the pilot library XMI
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: build/pilot-library-xmi
         key: pilot-library-xmi-${{ hashFiles('scripts/download-pilot-library-xmi.sh', 'scripts/pilot-pin.sh') }}
@@ -147,7 +147,7 @@ runs:
     # and its pin. A restored cache is verified by the script's own check.
     - name: Cache the Reference-FMUs
       if: inputs.reference-fmus == 'true'
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: examples/reference-fmus
         key: reference-fmus-${{ hashFiles('scripts/download-reference-fmus.sh', 'scripts/reference-fmus-pin.sh') }}
diff --git a/.github/workflows/extension-libraries-upstream.yml b/.github/workflows/extension-libraries-upstream.yml
index 905975dee3..fb0499cade 100644
--- a/.github/workflows/extension-libraries-upstream.yml
+++ b/.github/workflows/extension-libraries-upstream.yml
@@ -41,10 +41,10 @@ jobs:
       OPENSYSML_REQUIRE_LLM_BENCH_TOOLCHAIN: "1"
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
           cache: true
@@ -52,7 +52,7 @@ jobs:
       # Node 24, as the WebAssembly gate pins: Node 22's WASI host crashes on the wasm
       # binaries, and the runner's own Node is older still.
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: '24'
 
diff --git a/.github/workflows/mcp-registry.yml b/.github/workflows/mcp-registry.yml
index 18946a33c6..28d0c3c64f 100644
--- a/.github/workflows/mcp-registry.yml
+++ b/.github/workflows/mcp-registry.yml
@@ -33,7 +33,7 @@ jobs:
       TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
       REGISTRY: ${{ github.event_name == 'workflow_dispatch' && inputs.registry || 'production' }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ env.TAG }}
       - name: Publish server.json
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 8d4087d15d..eb974b468a 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -49,7 +49,7 @@ jobs:
       publish: ${{ steps.pick.outputs.publish }}
     steps:
       - name: Check out develop
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ env.BRANCH }}
           # Full history: the candidates are the branch's own commits, walked from the head.
@@ -141,7 +141,7 @@ jobs:
       npm: ${{ steps.version.outputs.npm }}
     steps:
       - name: Check out the selected commit
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ needs.select.outputs.sha }}
           # Full history: the notes count commits since the last `v*` tag, and the
@@ -149,7 +149,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
           cache: true
@@ -164,7 +164,7 @@ jobs:
             client/node/package-lock.json
 
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.12'
 
@@ -649,7 +649,7 @@ jobs:
       # is never rebuilt, so the registry jobs must be able to re-run from what this run kept.
       # A re-run of this job replaces what its earlier attempt kept, so it never trips over it.
       - name: Keep the Python distribution for the PyPI job
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: python-dist
           path: client/python/dist/
@@ -658,7 +658,7 @@ jobs:
           retention-days: 7
 
       - name: Keep the Jupyter kernel distribution for the PyPI job
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: jupyter-kernel-dist
           path: client/jupyter-kernel/dist/
@@ -667,7 +667,7 @@ jobs:
           retention-days: 7
 
       - name: Keep the npm tarballs for the npm job
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: npm-dist
           path: dist/npm/*.tgz
@@ -741,7 +741,7 @@ jobs:
       contents: write
     steps:
       - name: Check out the selected commit
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ needs.select.outputs.sha }}
 
@@ -816,13 +816,13 @@ jobs:
       id-token: write
     steps:
       - name: Fetch the Python distribution
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: python-dist
           path: client/python/dist/
 
       - name: Fetch the Jupyter kernel distribution
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: jupyter-kernel-dist
           path: client/jupyter-kernel/dist/
@@ -911,7 +911,7 @@ jobs:
           node -e "const [major, minor, patch] = require('child_process').execSync('npm --version').toString().trim().split('.').map(Number); if (major < 11 || (major === 11 && (minor < 5 || (minor === 5 && patch < 1)))) { console.error('npm 11.5.1 or later is required for trusted publishing'); process.exit(1); }"
 
       - name: Fetch the npm tarballs
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: npm-dist
           path: dist/npm/
diff --git a/.github/workflows/oracle-reproduction.yml b/.github/workflows/oracle-reproduction.yml
index 92f7ba7b5a..511faa5645 100644
--- a/.github/workflows/oracle-reproduction.yml
+++ b/.github/workflows/oracle-reproduction.yml
@@ -34,15 +34,15 @@ jobs:
     timeout-minutes: 90
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
 
       # The pinned pilot implementation is a Java artifact and the two bridges
       # are plain-Java programs compiled against it.
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
         with:
           distribution: temurin
           java-version: '21'
@@ -117,7 +117,7 @@ jobs:
       # reproducing the environment.
       - name: Upload the fresh reports
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: oracle-reports
           path: |
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 0c29d0d92e..1c3b483f7d 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -26,13 +26,13 @@ jobs:
       contents: read
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           # Full history: the in-browser engine is stamped by git describe below.
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.12'
           cache: pip
@@ -41,13 +41,13 @@ jobs:
       # The test-suite figures are counted from the tree by tools/cmd/doc-counts as the
       # site is built, so the build needs the Go toolchain.
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
           cache: true
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: '22'
           cache: npm
@@ -59,7 +59,7 @@ jobs:
         run: make docs-install
 
       - name: Configure GitHub Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
 
       # /cli/ runs the engine in the browser; the same target a local preview uses
       # compiles it into docs/assets (never vendored) for mkdocs to copy into site/.
@@ -73,7 +73,7 @@ jobs:
         run: make docs
 
       - name: Upload GitHub Pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
         with:
           path: site
 
@@ -91,4 +91,4 @@ jobs:
     steps:
       - name: Deploy GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 1645eb4bf1..3a45b406b9 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -71,7 +71,7 @@ jobs:
       syson: ${{ steps.areas.outputs.syson }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           fetch-depth: 0
 
@@ -125,17 +125,17 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
           cache: true
 
       # Node 24, as the WebAssembly gate pins: Node 22's WASI host crashes on the wasm binaries.
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: '24'
 
@@ -208,7 +208,7 @@ jobs:
 
       - name: Upload coverage artifact
         if: needs.changes.outputs.tier == 'full'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverage-${{ matrix.shard }}
           path: coverage.txt
@@ -226,10 +226,10 @@ jobs:
     # the same package, so their duplicate blocks are collapsed as make coverage does.
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Download shard profiles
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: coverage-*
           path: shards
@@ -247,7 +247,7 @@ jobs:
           python3 scripts/dedupe-coverage.py coverage.txt
 
       - name: Upload coverage artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverage
           path: coverage.txt
@@ -266,10 +266,10 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
           cache: true
@@ -305,7 +305,7 @@ jobs:
       # The npm runner: the packed @openmbee/sysml-mcp beside this platform's
       # package, installed from the tarballs, answers initialize and tools/list.
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: '22'
       - name: Test the npm runner
@@ -581,19 +581,19 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       # Not setup-go's shared cache, which another Go job saves first without the wasm objects:
       # the gate's own entry, saved by wasm-cache.yml on each develop push, is restored by prefix.
       - name: Set up Go
         id: go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
           cache: false
 
       - name: Restore the WebAssembly build cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cache/go-build
@@ -604,7 +604,7 @@ jobs:
             wasm-gate-${{ runner.os }}-go${{ steps.go.outputs.go-version }}-
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: '24'
 
@@ -635,16 +635,16 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
           cache: true
 
       - name: Cache the pilot Xpect suites
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: build/pilot-xpect-corpus
           key: pilot-xpect-corpus-${{ hashFiles('scripts/download-pilot-xpect.sh', 'scripts/pilot-pin.sh') }}
@@ -676,10 +676,10 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
           cache: true
@@ -718,7 +718,7 @@ jobs:
         run: go test -C tools -count=1 -v ./bench/llm
 
       - name: Upload binary artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: binaries
           path: bin/
@@ -838,27 +838,27 @@ jobs:
       OPENSYSML_REQUIRE_PDF_TOOLCHAIN: "1"
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
           cache: true
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: '22'
 
       - name: Set up Python
         id: setup-python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.12'
 
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
         with:
           distribution: temurin
           java-version: '21'
@@ -867,7 +867,7 @@ jobs:
       # toolchain's identity; the venv is not restored across Python builds.
       - name: Cache the PDF toolchain
         id: toolchain-cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: build/doc-pdf
           key: doc-pdf-toolchain-${{ runner.os }}-${{ hashFiles('scripts/download-doc-pdf-toolchain.sh') }}-py${{ steps.setup-python.outputs.python-version }}
@@ -908,10 +908,10 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: '22'
           cache: npm
@@ -937,7 +937,7 @@ jobs:
         run: npm run build:landing
 
       - name: Upload VS Code extension artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: vscode-extension
           path: editors/vscode/opensysml-sysml.vsix
@@ -953,17 +953,17 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: '22'
           cache: npm
           cache-dependency-path: editors/jupyterlab/package-lock.json
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.11'
 
@@ -980,7 +980,7 @@ jobs:
         run: make jupyterlab-build
 
       - name: Upload JupyterLab extension artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: jupyterlab-extension
           path: client/jupyter-kernel/labextension
@@ -995,15 +995,15 @@ jobs:
       contents: read
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: binaries
           path: bin
 
       # 17 is the plugin's compile target (the oldest supported Cameo runs on it).
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
         with:
           distribution: temurin
           java-version: '17'
@@ -1030,23 +1030,23 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.12'
           cache: pip
           cache-dependency-path: docs-requirements.txt
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
           cache: true
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: '22'
           cache: npm
@@ -1132,19 +1132,19 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       # The client verifies a download against the copy of the pinned digests it
       # ships, so a copy that drifts from the table pins something else.
       - name: Check the clients ship the pinned release digests
         run: python3 scripts/sync-release-digests.py --check
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: binaries
           path: bin
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: '22'
           cache: npm
@@ -1209,7 +1209,7 @@ jobs:
             echo "ok: $mutation is caught"
           done
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: node-conformance
           path: client/node/node-conformance.json
@@ -1241,7 +1241,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       # The client verifies a download against the copy of the pinned digests it
       # ships, so a copy that drifts from the table pins something else.
@@ -1249,13 +1249,13 @@ jobs:
         run: python3 scripts/sync-release-digests.py --check
 
       - name: Download binary artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: binaries
           path: bin
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.11'
 
@@ -1286,7 +1286,7 @@ jobs:
 
       # The FMI runner test's FMUs, same pin as the Go gate's.
       - name: Cache the Reference-FMUs
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: examples/reference-fmus
           key: reference-fmus-${{ hashFiles('scripts/download-reference-fmus.sh', 'scripts/reference-fmus-pin.sh') }}
@@ -1358,7 +1358,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       # The client verifies a download against the copy of the pinned digests it
       # ships, so a copy that drifts from the table pins something else.
@@ -1367,7 +1367,7 @@ jobs:
 
       # Reuse the service built by the Go job rather than installing Go again
       # in this Rust-focused gate.
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: binaries
           path: bin
@@ -1431,7 +1431,7 @@ jobs:
           git add -N client/rust/opensysml/src/proto client/rust/conformance/sysml.descriptor.binpb
           git diff --exit-code client/rust/opensysml/src/proto client/rust/conformance/sysml.descriptor.binpb
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: conformance-report-rust
           path: bin/conformance-report-rust.json
@@ -1449,9 +1449,9 @@ jobs:
       matrix:
         julia-version: ['1.10', 'lts']
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: binaries
           path: bin
@@ -1479,7 +1479,7 @@ jobs:
             --binary "$GITHUB_WORKSPACE/bin/sysml-grpc" \
             --report bin/conformance-report-julia.json
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: conformance-report-julia-${{ matrix.julia-version }}
           path: bin/conformance-report-julia.json
@@ -1497,9 +1497,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: binaries
           path: bin
@@ -1516,7 +1516,7 @@ jobs:
 
       - name: Restore the archives Octave was installed from
         id: apt-archives
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ runner.temp }}/apt-archives
           key: apt-octave-${{ runner.os }}-${{ steps.image.outputs.version }}-
@@ -1539,7 +1539,7 @@ jobs:
 
       - name: Keep the archives for the next run
         if: steps.apt-archives.outputs.cache-matched-key != format('apt-octave-{0}-{1}-{2}', runner.os, steps.image.outputs.version, steps.archives.outputs.digest)
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ runner.temp }}/apt-archives
           key: apt-octave-${{ runner.os }}-${{ steps.image.outputs.version }}-${{ steps.archives.outputs.digest }}
@@ -1567,7 +1567,7 @@ jobs:
         if: always()
         run: kill "$svc_pid" 2>/dev/null || true
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: conformance-report-matlab
           path: bin/conformance-report-matlab.json
@@ -1583,20 +1583,20 @@ jobs:
       contents: read
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       # The client verifies a download against the copy of the pinned digests it
       # ships, so a copy that drifts from the table pins something else.
       - name: Check the clients ship the pinned release digests
         run: python3 scripts/sync-release-digests.py --check
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: binaries
           path: bin
 
       # 17 is the client's compile target, so a 21-only construct fails here.
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
         with:
           distribution: temurin
           java-version: '17'
@@ -1619,7 +1619,7 @@ jobs:
             -binary bin/sysml-grpc -protocols connect,connect-json -allow-skips \
             -report conformance-report-java.json
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: java-conformance-report
@@ -1635,10 +1635,10 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Download binary artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: binaries
           path: bin
@@ -1648,7 +1648,7 @@ jobs:
 
       # SysON 2026.9.2 runs on 21; the module compiles at release 17.
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
         with:
           distribution: temurin
           java-version: '21'
@@ -1661,7 +1661,7 @@ jobs:
         run: mvn -B -f editors/syson/pom.xml install -Dopensysml.requireService=true
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: '24'
           cache: npm
@@ -1684,9 +1684,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
           cache: true
@@ -1717,7 +1717,7 @@ jobs:
         run: make conformance-mcp
 
       # if: always() — the reports matter most when a gate failed and halted the job.
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: conformance-reports
diff --git a/.github/workflows/release-windows.yml b/.github/workflows/release-windows.yml
index de8b34d062..71c92a56c0 100644
--- a/.github/workflows/release-windows.yml
+++ b/.github/workflows/release-windows.yml
@@ -67,12 +67,12 @@ jobs:
       sign: ${{ steps.gate.outputs.sign }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       - name: Set up Go
-        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
           cache: true
@@ -133,7 +133,7 @@ jobs:
 
       - name: Upload unsigned binaries
         id: upload
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ env.UNSIGNED_ARTIFACT }}
           path: dist/unsigned/*.exe
@@ -141,7 +141,7 @@ jobs:
           retention-days: 14
 
       - name: Upload the MSI packaging inputs
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ env.MSI_INPUTS_ARTIFACT }}
           path: |
@@ -190,13 +190,13 @@ jobs:
     steps:
       # No checkout: the tagged tree holds paths Windows cannot check out; the build job ships what the MSI needs.
       - name: Download the MSI packaging inputs
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.MSI_INPUTS_ARTIFACT }}
           path: .
 
       - name: Download the unsigned binaries
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.UNSIGNED_ARTIFACT }}
           path: dist/unsigned
@@ -218,7 +218,7 @@ jobs:
           (cd dist/release && sha256sum ./*.msi | sed 's|\./||' | tee SHA256SUMS-windows-msi.txt)
 
       - name: Upload the unsigned MSI as a workflow artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ env.UNSIGNED_MSI_ARTIFACT }}
           path: dist/release/
@@ -237,12 +237,12 @@ jobs:
       contents: write
     steps:
       - name: Check out repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       - name: Download the unsigned MSI
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.UNSIGNED_MSI_ARTIFACT }}
           path: dist/release
@@ -275,12 +275,12 @@ jobs:
       artifact-id: ${{ steps.upload.outputs.artifact-id }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       - name: Set up Go
-        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
           cache: true
@@ -323,7 +323,7 @@ jobs:
 
       - name: Upload signed binaries
         id: upload
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ env.SIGNED_EXE_ARTIFACT }}
           path: dist/signed/*.exe
@@ -343,7 +343,7 @@ jobs:
     steps:
       # No checkout: the tagged tree holds paths Windows cannot check out; the build job ships what the MSI needs.
       - name: Download the MSI packaging inputs
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.MSI_INPUTS_ARTIFACT }}
           path: .
@@ -358,7 +358,7 @@ jobs:
           fi
 
       - name: Download the signed binaries
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.SIGNED_EXE_ARTIFACT }}
           path: dist/signed
@@ -380,7 +380,7 @@ jobs:
 
       - name: Upload the MSI for signing
         id: upload
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ env.PRESIGN_MSI_ARTIFACT }}
           path: dist/presign/*.msi
@@ -412,7 +412,7 @@ jobs:
           ls -la dist/release
 
       - name: Upload the signed MSI
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: windows-amd64-msi-signed
           path: dist/release/*.msi
@@ -428,13 +428,13 @@ jobs:
       contents: write
     steps:
       - name: Download the signed binaries
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.SIGNED_EXE_ARTIFACT }}
           path: dist/signed
 
       - name: Download the signed MSI
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: windows-amd64-msi-signed
           path: dist/release
@@ -442,7 +442,7 @@ jobs:
       # No checkout here either; the LICENSE the sysml-mcp zip carries comes
       # from the packaging inputs the build job uploaded.
       - name: Download the MSI packaging inputs
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ env.MSI_INPUTS_ARTIFACT }}
           path: .
@@ -472,7 +472,7 @@ jobs:
           cat SHA256SUMS-windows-signed.txt
 
       - name: Upload signed assets as a workflow artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: windows-amd64-signed
           path: dist/release/
diff --git a/.github/workflows/syson-artifacts.yml b/.github/workflows/syson-artifacts.yml
index fb70d91054..f4b2686667 100644
--- a/.github/workflows/syson-artifacts.yml
+++ b/.github/workflows/syson-artifacts.yml
@@ -15,14 +15,14 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_PACKAGES_READ_TOKEN }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Build the service binary
         run: make build-grpc
 
       # SysON 2026.9.2 runs on 21; the module compiles at release 17.
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
         with:
           distribution: temurin
           java-version: '21'
@@ -35,7 +35,7 @@ jobs:
         run: mvn -B -s editors/syson/settings.xml -f editors/syson/pom.xml -Psyson-artifacts -P '!stubs' install -Dopensysml.requireService=true
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: '24'
           cache: npm
diff --git a/.github/workflows/upstream-drift.yml b/.github/workflows/upstream-drift.yml
index 04d98d85f5..4a85aafaf1 100644
--- a/.github/workflows/upstream-drift.yml
+++ b/.github/workflows/upstream-drift.yml
@@ -24,7 +24,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Compare upstream with scripts/pilot-pin.sh
         id: drift
diff --git a/.github/workflows/validate-action.yml b/.github/workflows/validate-action.yml
index 8cd32d1669..5fe1fa9cab 100644
--- a/.github/workflows/validate-action.yml
+++ b/.github/workflows/validate-action.yml
@@ -30,7 +30,7 @@ jobs:
     outputs:
       installer: ${{ steps.installer.outputs.installer }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           fetch-depth: 0
       - name: Decide whether the installed release runs
@@ -46,8 +46,8 @@ jobs:
     name: From the tree
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
           cache: true
@@ -130,7 +130,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - name: Validate the showcase with the latest release
         uses: ./
         with:
diff --git a/.github/workflows/wasm-cache.yml b/.github/workflows/wasm-cache.yml
index eb471d2fe1..9412660f94 100644
--- a/.github/workflows/wasm-cache.yml
+++ b/.github/workflows/wasm-cache.yml
@@ -30,17 +30,17 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Set up Go
         id: go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
           cache: false
 
       - name: Restore the WebAssembly build cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cache/go-build
@@ -51,7 +51,7 @@ jobs:
             wasm-gate-${{ runner.os }}-go${{ steps.go.outputs.go-version }}-
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: '24'
 
@@ -69,7 +69,7 @@ jobs:
       # develop still warms the next pull request.
       - name: Save the WebAssembly build cache
         if: success() || failure()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cache/go-build
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 4f2e7ac8c9..07e6ca63ec 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -303,6 +303,11 @@ tier; `CI_TIER=quick` keeps the clients and docs to their own paths). A path no
 turns every area on, so a new directory is over-tested rather than untested — teach the script
 about it, and add a case to `scripts/ci-changed-areas-test.sh`, which the same job runs.
 
+Every third-party action a workflow or composite action `uses:` is pinned to a full commit SHA
+with the release it resolves to as a trailing comment (`actions/checkout@<sha> # v5.1.0`), one
+pin per action across the repository; a new step takes the same form, and the comment is what
+lets the pin be moved by version.
+
 ### CircleCI
 
 `.circleci/config.yml` runs after a merge and on tags, never on a pull request branch:
diff --git a/action.yml b/action.yml
index 7858da0fc6..8469767fb0 100644
--- a/action.yml
+++ b/action.yml
@@ -141,7 +141,7 @@ runs:
 
     - name: Upload the SARIF report
       if: ${{ inputs.format == 'sarif' && inputs.upload-sarif == 'true' }}
-      uses: github/codeql-action/upload-sarif@v4
+      uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
       with:
         sarif_file: ${{ inputs.sarif-file }}
 
diff --git a/changes/unreleased/pin-github-actions.security.md b/changes/unreleased/pin-github-actions.security.md
new file mode 100644
index 0000000000..1adc764ea0
--- /dev/null
+++ b/changes/unreleased/pin-github-actions.security.md
@@ -0,0 +1 @@
+- **Every third-party GitHub Action the workflows use is pinned to a commit SHA.** The 98 `uses:` references that floated on a mutable tag (`actions/checkout@v4`, `actions/setup-go@v5`, `actions/upload-artifact@v4`, …) now name the full commit of a verified release with the version as a trailing comment, one pin per action across the workflows and the composite actions, so a re-pointed tag can no longer change what a build runs.

From be2b9bceb8b9061df59035982d94cf2db0fc0451 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 27 Oct 2026 17:18:55 +0000
Subject: [PATCH 2/2] chore(ci): pin each floating action at the commit its tag
 resolves to, no version moves

Co-Authored-By: jason.han <hanhuijun@gmail.com>
---
 .../extension-libraries-upstream.yml          |   6 +-
 .github/workflows/mcp-registry.yml            |   2 +-
 .github/workflows/nightly.yml                 |  22 ++--
 .github/workflows/oracle-reproduction.yml     |   6 +-
 .github/workflows/pages.yml                   |   8 +-
 .github/workflows/pr.yml                      | 122 +++++++++---------
 .github/workflows/release-windows.yml         |  40 +++---
 .github/workflows/syson-artifacts.yml         |   4 +-
 .github/workflows/upstream-drift.yml          |   2 +-
 .github/workflows/validate-action.yml         |   8 +-
 .github/workflows/wasm-cache.yml              |   6 +-
 CONTRIBUTING.md                               |   5 +-
 .../unreleased/pin-github-actions.security.md |   2 +-
 13 files changed, 116 insertions(+), 117 deletions(-)

diff --git a/.github/workflows/extension-libraries-upstream.yml b/.github/workflows/extension-libraries-upstream.yml
index fb0499cade..7026a04e66 100644
--- a/.github/workflows/extension-libraries-upstream.yml
+++ b/.github/workflows/extension-libraries-upstream.yml
@@ -41,10 +41,10 @@ jobs:
       OPENSYSML_REQUIRE_LLM_BENCH_TOOLCHAIN: "1"
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: true
@@ -52,7 +52,7 @@ jobs:
       # Node 24, as the WebAssembly gate pins: Node 22's WASI host crashes on the wasm
       # binaries, and the runner's own Node is older still.
       - name: Set up Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '24'
 
diff --git a/.github/workflows/mcp-registry.yml b/.github/workflows/mcp-registry.yml
index 28d0c3c64f..18946a33c6 100644
--- a/.github/workflows/mcp-registry.yml
+++ b/.github/workflows/mcp-registry.yml
@@ -33,7 +33,7 @@ jobs:
       TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
       REGISTRY: ${{ github.event_name == 'workflow_dispatch' && inputs.registry || 'production' }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ env.TAG }}
       - name: Publish server.json
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index eb974b468a..8d4087d15d 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -49,7 +49,7 @@ jobs:
       publish: ${{ steps.pick.outputs.publish }}
     steps:
       - name: Check out develop
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ env.BRANCH }}
           # Full history: the candidates are the branch's own commits, walked from the head.
@@ -141,7 +141,7 @@ jobs:
       npm: ${{ steps.version.outputs.npm }}
     steps:
       - name: Check out the selected commit
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ needs.select.outputs.sha }}
           # Full history: the notes count commits since the last `v*` tag, and the
@@ -149,7 +149,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -164,7 +164,7 @@ jobs:
             client/node/package-lock.json
 
       - name: Set up Python
-        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
 
@@ -649,7 +649,7 @@ jobs:
       # is never rebuilt, so the registry jobs must be able to re-run from what this run kept.
       # A re-run of this job replaces what its earlier attempt kept, so it never trips over it.
       - name: Keep the Python distribution for the PyPI job
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: python-dist
           path: client/python/dist/
@@ -658,7 +658,7 @@ jobs:
           retention-days: 7
 
       - name: Keep the Jupyter kernel distribution for the PyPI job
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: jupyter-kernel-dist
           path: client/jupyter-kernel/dist/
@@ -667,7 +667,7 @@ jobs:
           retention-days: 7
 
       - name: Keep the npm tarballs for the npm job
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: npm-dist
           path: dist/npm/*.tgz
@@ -741,7 +741,7 @@ jobs:
       contents: write
     steps:
       - name: Check out the selected commit
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ needs.select.outputs.sha }}
 
@@ -816,13 +816,13 @@ jobs:
       id-token: write
     steps:
       - name: Fetch the Python distribution
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: python-dist
           path: client/python/dist/
 
       - name: Fetch the Jupyter kernel distribution
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: jupyter-kernel-dist
           path: client/jupyter-kernel/dist/
@@ -911,7 +911,7 @@ jobs:
           node -e "const [major, minor, patch] = require('child_process').execSync('npm --version').toString().trim().split('.').map(Number); if (major < 11 || (major === 11 && (minor < 5 || (minor === 5 && patch < 1)))) { console.error('npm 11.5.1 or later is required for trusted publishing'); process.exit(1); }"
 
       - name: Fetch the npm tarballs
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: npm-dist
           path: dist/npm/
diff --git a/.github/workflows/oracle-reproduction.yml b/.github/workflows/oracle-reproduction.yml
index 511faa5645..354a997796 100644
--- a/.github/workflows/oracle-reproduction.yml
+++ b/.github/workflows/oracle-reproduction.yml
@@ -34,10 +34,10 @@ jobs:
     timeout-minutes: 90
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
 
       # The pinned pilot implementation is a Java artifact and the two bridges
       # are plain-Java programs compiled against it.
@@ -117,7 +117,7 @@ jobs:
       # reproducing the environment.
       - name: Upload the fresh reports
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: oracle-reports
           path: |
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 1c3b483f7d..792bd47212 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -26,13 +26,13 @@ jobs:
       contents: read
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           # Full history: the in-browser engine is stamped by git describe below.
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.12'
           cache: pip
@@ -41,13 +41,13 @@ jobs:
       # The test-suite figures are counted from the tree by tools/cmd/doc-counts as the
       # site is built, so the build needs the Go toolchain.
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: true
 
       - name: Set up Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
           cache: npm
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 3a45b406b9..7baa883a8e 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -71,7 +71,7 @@ jobs:
       syson: ${{ steps.areas.outputs.syson }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
@@ -125,17 +125,17 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: true
 
       # Node 24, as the WebAssembly gate pins: Node 22's WASI host crashes on the wasm binaries.
       - name: Set up Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '24'
 
@@ -208,7 +208,7 @@ jobs:
 
       - name: Upload coverage artifact
         if: needs.changes.outputs.tier == 'full'
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: coverage-${{ matrix.shard }}
           path: coverage.txt
@@ -226,10 +226,10 @@ jobs:
     # the same package, so their duplicate blocks are collapsed as make coverage does.
     steps:
       - name: Checkout
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Download shard profiles
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           pattern: coverage-*
           path: shards
@@ -247,7 +247,7 @@ jobs:
           python3 scripts/dedupe-coverage.py coverage.txt
 
       - name: Upload coverage artifact
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: coverage
           path: coverage.txt
@@ -266,10 +266,10 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: true
@@ -305,7 +305,7 @@ jobs:
       # The npm runner: the packed @openmbee/sysml-mcp beside this platform's
       # package, installed from the tarballs, answers initialize and tools/list.
       - name: Set up Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
       - name: Test the npm runner
@@ -581,13 +581,13 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # Not setup-go's shared cache, which another Go job saves first without the wasm objects:
       # the gate's own entry, saved by wasm-cache.yml on each develop push, is restored by prefix.
       - name: Set up Go
         id: go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: false
@@ -604,7 +604,7 @@ jobs:
             wasm-gate-${{ runner.os }}-go${{ steps.go.outputs.go-version }}-
 
       - name: Set up Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '24'
 
@@ -635,10 +635,10 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: true
@@ -676,10 +676,10 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: true
@@ -718,7 +718,7 @@ jobs:
         run: go test -C tools -count=1 -v ./bench/llm
 
       - name: Upload binary artifacts
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: binaries
           path: bin/
@@ -838,22 +838,22 @@ jobs:
       OPENSYSML_REQUIRE_PDF_TOOLCHAIN: "1"
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: true
 
       - name: Set up Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
 
       - name: Set up Python
         id: setup-python
-        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.12'
 
@@ -908,10 +908,10 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
           cache: npm
@@ -937,7 +937,7 @@ jobs:
         run: npm run build:landing
 
       - name: Upload VS Code extension artifact
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: vscode-extension
           path: editors/vscode/opensysml-sysml.vsix
@@ -953,17 +953,17 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
           cache: npm
           cache-dependency-path: editors/jupyterlab/package-lock.json
 
       - name: Set up Python
-        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.11'
 
@@ -980,7 +980,7 @@ jobs:
         run: make jupyterlab-build
 
       - name: Upload JupyterLab extension artifact
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: jupyterlab-extension
           path: client/jupyter-kernel/labextension
@@ -995,9 +995,9 @@ jobs:
       contents: read
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: binaries
           path: bin
@@ -1030,23 +1030,23 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Python
-        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.12'
           cache: pip
           cache-dependency-path: docs-requirements.txt
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: true
 
       - name: Set up Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
           cache: npm
@@ -1132,19 +1132,19 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # The client verifies a download against the copy of the pinned digests it
       # ships, so a copy that drifts from the table pins something else.
       - name: Check the clients ship the pinned release digests
         run: python3 scripts/sync-release-digests.py --check
 
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: binaries
           path: bin
 
-      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
           cache: npm
@@ -1209,7 +1209,7 @@ jobs:
             echo "ok: $mutation is caught"
           done
 
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: node-conformance
           path: client/node/node-conformance.json
@@ -1241,7 +1241,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # The client verifies a download against the copy of the pinned digests it
       # ships, so a copy that drifts from the table pins something else.
@@ -1249,13 +1249,13 @@ jobs:
         run: python3 scripts/sync-release-digests.py --check
 
       - name: Download binary artifacts
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: binaries
           path: bin
 
       - name: Set up Python
-        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.11'
 
@@ -1358,7 +1358,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # The client verifies a download against the copy of the pinned digests it
       # ships, so a copy that drifts from the table pins something else.
@@ -1367,7 +1367,7 @@ jobs:
 
       # Reuse the service built by the Go job rather than installing Go again
       # in this Rust-focused gate.
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: binaries
           path: bin
@@ -1431,7 +1431,7 @@ jobs:
           git add -N client/rust/opensysml/src/proto client/rust/conformance/sysml.descriptor.binpb
           git diff --exit-code client/rust/opensysml/src/proto client/rust/conformance/sysml.descriptor.binpb
 
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: conformance-report-rust
           path: bin/conformance-report-rust.json
@@ -1449,9 +1449,9 @@ jobs:
       matrix:
         julia-version: ['1.10', 'lts']
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: binaries
           path: bin
@@ -1479,7 +1479,7 @@ jobs:
             --binary "$GITHUB_WORKSPACE/bin/sysml-grpc" \
             --report bin/conformance-report-julia.json
 
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: conformance-report-julia-${{ matrix.julia-version }}
           path: bin/conformance-report-julia.json
@@ -1497,9 +1497,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: binaries
           path: bin
@@ -1567,7 +1567,7 @@ jobs:
         if: always()
         run: kill "$svc_pid" 2>/dev/null || true
 
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: conformance-report-matlab
           path: bin/conformance-report-matlab.json
@@ -1583,14 +1583,14 @@ jobs:
       contents: read
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # The client verifies a download against the copy of the pinned digests it
       # ships, so a copy that drifts from the table pins something else.
       - name: Check the clients ship the pinned release digests
         run: python3 scripts/sync-release-digests.py --check
 
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: binaries
           path: bin
@@ -1619,7 +1619,7 @@ jobs:
             -binary bin/sysml-grpc -protocols connect,connect-json -allow-skips \
             -report conformance-report-java.json
 
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: java-conformance-report
@@ -1635,10 +1635,10 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Download binary artifacts
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: binaries
           path: bin
@@ -1661,7 +1661,7 @@ jobs:
         run: mvn -B -f editors/syson/pom.xml install -Dopensysml.requireService=true
 
       - name: Set up Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '24'
           cache: npm
@@ -1684,9 +1684,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: true
@@ -1717,7 +1717,7 @@ jobs:
         run: make conformance-mcp
 
       # if: always() — the reports matter most when a gate failed and halted the job.
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: conformance-reports
diff --git a/.github/workflows/release-windows.yml b/.github/workflows/release-windows.yml
index 71c92a56c0..de8b34d062 100644
--- a/.github/workflows/release-windows.yml
+++ b/.github/workflows/release-windows.yml
@@ -67,12 +67,12 @@ jobs:
       sign: ${{ steps.gate.outputs.sign }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -133,7 +133,7 @@ jobs:
 
       - name: Upload unsigned binaries
         id: upload
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ env.UNSIGNED_ARTIFACT }}
           path: dist/unsigned/*.exe
@@ -141,7 +141,7 @@ jobs:
           retention-days: 14
 
       - name: Upload the MSI packaging inputs
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ env.MSI_INPUTS_ARTIFACT }}
           path: |
@@ -190,13 +190,13 @@ jobs:
     steps:
       # No checkout: the tagged tree holds paths Windows cannot check out; the build job ships what the MSI needs.
       - name: Download the MSI packaging inputs
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ env.MSI_INPUTS_ARTIFACT }}
           path: .
 
       - name: Download the unsigned binaries
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ env.UNSIGNED_ARTIFACT }}
           path: dist/unsigned
@@ -218,7 +218,7 @@ jobs:
           (cd dist/release && sha256sum ./*.msi | sed 's|\./||' | tee SHA256SUMS-windows-msi.txt)
 
       - name: Upload the unsigned MSI as a workflow artifact
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ env.UNSIGNED_MSI_ARTIFACT }}
           path: dist/release/
@@ -237,12 +237,12 @@ jobs:
       contents: write
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       - name: Download the unsigned MSI
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ env.UNSIGNED_MSI_ARTIFACT }}
           path: dist/release
@@ -275,12 +275,12 @@ jobs:
       artifact-id: ${{ steps.upload.outputs.artifact-id }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -323,7 +323,7 @@ jobs:
 
       - name: Upload signed binaries
         id: upload
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ env.SIGNED_EXE_ARTIFACT }}
           path: dist/signed/*.exe
@@ -343,7 +343,7 @@ jobs:
     steps:
       # No checkout: the tagged tree holds paths Windows cannot check out; the build job ships what the MSI needs.
       - name: Download the MSI packaging inputs
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ env.MSI_INPUTS_ARTIFACT }}
           path: .
@@ -358,7 +358,7 @@ jobs:
           fi
 
       - name: Download the signed binaries
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ env.SIGNED_EXE_ARTIFACT }}
           path: dist/signed
@@ -380,7 +380,7 @@ jobs:
 
       - name: Upload the MSI for signing
         id: upload
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ env.PRESIGN_MSI_ARTIFACT }}
           path: dist/presign/*.msi
@@ -412,7 +412,7 @@ jobs:
           ls -la dist/release
 
       - name: Upload the signed MSI
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: windows-amd64-msi-signed
           path: dist/release/*.msi
@@ -428,13 +428,13 @@ jobs:
       contents: write
     steps:
       - name: Download the signed binaries
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ env.SIGNED_EXE_ARTIFACT }}
           path: dist/signed
 
       - name: Download the signed MSI
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: windows-amd64-msi-signed
           path: dist/release
@@ -442,7 +442,7 @@ jobs:
       # No checkout here either; the LICENSE the sysml-mcp zip carries comes
       # from the packaging inputs the build job uploaded.
       - name: Download the MSI packaging inputs
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ env.MSI_INPUTS_ARTIFACT }}
           path: .
@@ -472,7 +472,7 @@ jobs:
           cat SHA256SUMS-windows-signed.txt
 
       - name: Upload signed assets as a workflow artifact
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: windows-amd64-signed
           path: dist/release/
diff --git a/.github/workflows/syson-artifacts.yml b/.github/workflows/syson-artifacts.yml
index f4b2686667..6b6c59e1a9 100644
--- a/.github/workflows/syson-artifacts.yml
+++ b/.github/workflows/syson-artifacts.yml
@@ -15,7 +15,7 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_PACKAGES_READ_TOKEN }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Build the service binary
         run: make build-grpc
@@ -35,7 +35,7 @@ jobs:
         run: mvn -B -s editors/syson/settings.xml -f editors/syson/pom.xml -Psyson-artifacts -P '!stubs' install -Dopensysml.requireService=true
 
       - name: Set up Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '24'
           cache: npm
diff --git a/.github/workflows/upstream-drift.yml b/.github/workflows/upstream-drift.yml
index 4a85aafaf1..3299d6d229 100644
--- a/.github/workflows/upstream-drift.yml
+++ b/.github/workflows/upstream-drift.yml
@@ -24,7 +24,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Compare upstream with scripts/pilot-pin.sh
         id: drift
diff --git a/.github/workflows/validate-action.yml b/.github/workflows/validate-action.yml
index 5fe1fa9cab..e783ed4281 100644
--- a/.github/workflows/validate-action.yml
+++ b/.github/workflows/validate-action.yml
@@ -30,7 +30,7 @@ jobs:
     outputs:
       installer: ${{ steps.installer.outputs.installer }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
       - name: Decide whether the installed release runs
@@ -46,8 +46,8 @@ jobs:
     name: From the tree
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: true
@@ -130,7 +130,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Validate the showcase with the latest release
         uses: ./
         with:
diff --git a/.github/workflows/wasm-cache.yml b/.github/workflows/wasm-cache.yml
index 9412660f94..9f367c3354 100644
--- a/.github/workflows/wasm-cache.yml
+++ b/.github/workflows/wasm-cache.yml
@@ -30,11 +30,11 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Check out repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Go
         id: go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: false
@@ -51,7 +51,7 @@ jobs:
             wasm-gate-${{ runner.os }}-go${{ steps.go.outputs.go-version }}-
 
       - name: Set up Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '24'
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 07e6ca63ec..9a689b8c31 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -304,9 +304,8 @@ turns every area on, so a new directory is over-tested rather than untested —
 about it, and add a case to `scripts/ci-changed-areas-test.sh`, which the same job runs.
 
 Every third-party action a workflow or composite action `uses:` is pinned to a full commit SHA
-with the release it resolves to as a trailing comment (`actions/checkout@<sha> # v5.1.0`), one
-pin per action across the repository; a new step takes the same form, and the comment is what
-lets the pin be moved by version.
+with the release that commit is as a trailing comment (`actions/checkout@<sha> # v4.4.0`); a new
+step takes the same form, and the comment is what lets the pin be moved by version.
 
 ### CircleCI
 
diff --git a/changes/unreleased/pin-github-actions.security.md b/changes/unreleased/pin-github-actions.security.md
index 1adc764ea0..0256e07708 100644
--- a/changes/unreleased/pin-github-actions.security.md
+++ b/changes/unreleased/pin-github-actions.security.md
@@ -1 +1 @@
-- **Every third-party GitHub Action the workflows use is pinned to a commit SHA.** The 98 `uses:` references that floated on a mutable tag (`actions/checkout@v4`, `actions/setup-go@v5`, `actions/upload-artifact@v4`, …) now name the full commit of a verified release with the version as a trailing comment, one pin per action across the workflows and the composite actions, so a re-pointed tag can no longer change what a build runs.
+- **Every third-party GitHub Action the workflows use is pinned to a commit SHA.** The 98 `uses:` references that floated on a mutable tag (`actions/checkout@v4`, `actions/setup-go@v5`, `actions/upload-artifact@v4`, …) now name the full commit that tag resolves to, with its release as a trailing comment, so a re-pointed tag can no longer change what a build runs.