From ffa7ea961abb39b99a5f97950f550029ec425660 Mon Sep 17 00:00:00 2001
From: IC-1101asterisk <77051033+IC-1101asterisk@users.noreply.github.com>
Date: Tue, 7 Jul 2026 10:57:13 +0000
Subject: [PATCH 1/2] chore: pin GitHub Actions to commit SHAs

Pin third-party GitHub Actions referenced in workflows to immutable
commit SHAs, with the original ref kept as a comment.
---
 .github/workflows/ci-cd.yaml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci-cd.yaml b/.github/workflows/ci-cd.yaml
index 353246b..53acb58 100644
--- a/.github/workflows/ci-cd.yaml
+++ b/.github/workflows/ci-cd.yaml
@@ -33,16 +33,16 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
         with:
           version: "0.8.23"
           enable-cache: true
 
       - name: Set up Python ${{ matrix.python }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: ${{ matrix.python }}
 
@@ -75,14 +75,14 @@ jobs:
 
       - name: Archive code coverage results
         if: matrix.python == '3.11'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: code-coverage-report
           path: /home/runner/cov_html
 
       - name: Checkout to current branch for coverage update
         if: github.event_name == 'pull_request' && matrix.python == '3.11'
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -108,7 +108,7 @@ jobs:
 
       - name: Commit coverage badge
         if: github.event_name == 'pull_request' && matrix.python == '3.11'
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
         with:
           add: badges/cov_badge.svg
           default_author: github_actor

From f8f129b58d2f9b776aba5082024e6543c391fda9 Mon Sep 17 00:00:00 2001
From: IC-1101asterisk <IC-1101asterisk@users.noreply.github.com>
Date: Tue, 7 Jul 2026 10:59:18 +0000
Subject: [PATCH 2/2] update coverage badge

---
 badges/cov_badge.svg | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/badges/cov_badge.svg b/badges/cov_badge.svg
index 5c5f69b..f46e5d1 100644
--- a/badges/cov_badge.svg
+++ b/badges/cov_badge.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="96" height="20" role="img" aria-label="coverage: 68%"><title>coverage: 68%</title><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="96" height="20" rx="3" fill="#fff"/></clipPath><g clip-path="url(#r)"><rect width="61" height="20" fill="#555"/><rect x="61" width="35" height="20" fill="#fe7d37"/><rect width="96" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><text aria-hidden="true" x="315" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="510">coverage</text><text x="315" y="140" transform="scale(.1)" fill="#fff" textLength="510">coverage</text><text aria-hidden="true" x="775" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="250">68%</text><text x="775" y="140" transform="scale(.1)" fill="#fff" textLength="250">68%</text></g></svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="96" height="20" role="img" aria-label="coverage: 68%"><title>coverage: 68%</title><filter id="blur"><feGaussianBlur stdDeviation="16"/></filter><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="96" height="20" rx="3"/></clipPath><g clip-path="url(#r)"><rect width="61" height="20" fill="#555"/><rect x="61" width="35" height="20" fill="#ea7233"/><rect width="96" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="315" y="150" fill-opacity=".8" filter="url(#blur)" textLength="510">coverage</text><text x="315" y="150" fill-opacity=".3" textLength="510">coverage</text></g><text x="315" y="140" textLength="510">coverage</text></g><g transform="scale(.1)"><g aria-hidden="true" fill="#010101"><text x="775" y="150" fill-opacity=".8" filter="url(#blur)" textLength="250">68%</text><text x="775" y="150" fill-opacity=".3" textLength="250">68%</text></g><text x="775" y="140" textLength="250">68%</text></g></g></svg>