[codekongdev]

Summary

Pin actions/checkout v7.0.1 and actions/setup-node v7.1.0 to their official release commit SHAs so moving version tags cannot change the code run by CI. Version comments identify the releases; triggers, permissions, Node version, and check commands are unchanged.

Type of change

• CI or tooling

How I verified it

• Resolved each official upstream v7 tag and exact release tag to the same commit and checked GitHub's verified commit signature status.
• Independently reviewed both 40-character SHA references and confirmed that normalizing them back to @v7 reproduces the original workflow byte for byte.
• Ran git diff --check -- .github/workflows/check.yml successfully.
• GitHub Actions will run the repository checks on this PR.

Checklist

• README checks are outside this change's scope.
• ENGINE and UI_TEXT are unchanged.
• No personal settings, generated pages, or screenshots are included.
• No new external URLs or shell commands are introduced.
• This is not a new skill.

[coderabbitai]

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

• Chores
  • Updated the automated checks’ action references. Their versions and behavior remain unchanged; there are no user-facing changes.

The workflow now pins actions/checkout and actions/setup-node to specific commit SHAs instead of the v7 tags. The action versions remain unchanged.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: Minimal · up to 332a3

The workflow behavior is preserved while both actions are securely pinned to verified release commits.

Architecture risk: Low · up to 332a3

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/check.yml: Both GitHub Actions references now use commit SHAs instead of the v7 tags.

Recent review info

Run configuration

• Source mode: Auto
• Repository: codekongdev/plz
• Branch: chore/pin-actions-security
• File: .coderabbit.yaml
• Commit: 332a3b2
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: c3cb589f-23aa-40f9-94c7-55305e781c12

Commits

Reviewing files that changed from the base of the PR and between ad5c454 and 332a3b2.

Files selected for processing: 1

• .github/workflows/check.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.