ci: pin workflow actions to commits rather than tags

.github/workflows/ci.yml

@@ -28,9 +28,9 @@ jobs:
         php: ['8.2', '8.3', '8.4']
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: ${{ matrix.php }}
 

CHANGELOG.md

@@ -4,6 +4,23 @@ This package is the wire contract between the Manager platform and the connector
 A change here is a change to what a site may send, so every entry says what was added and - more
 usefully - what was deliberately left out of it.
 
+## 1.8.1 - 2026-08-09
+
+No wire change. No schema, canonical string, signature or fixture moved, so this is interchangeable
+with 1.8.0 on either side of the protocol.
+
+### Build
+
+- **CI pins its actions to commits rather than to tags.** `actions/checkout@v4` and
+  `shivammathur/setup-php@v2` are moving references - whoever controls those repositories can point
+  them at different code without the tag changing. This package is the signing contract two other
+  packages resolve against, so the job that decides whether a change to it is sound is a job worth
+  knowing the contents of. `platform` and `manager-restore` already pin these same two commits; this
+  brings the last one into line.
+
+  The run reaches little - `contents: read`, no secrets beyond `GITHUB_TOKEN`, no
+  `pull_request_target`, nothing published - which bounds it rather than excusing it.
+
 ## 1.8.0 - 2026-08-07
 
 Add-only. No existing schema, canonical string, signature or fixture moved, so a 1.7.1 platform and a

composer.json

@@ -1,7 +1,7 @@
 {
     "name": "coysh-digital/manager-protocol",
     "description": "Wire contract shared by the Manager platform and the Manager Connector for Craft CMS.",
-    "version": "1.8.0",
+    "version": "1.8.1",
     "type": "library",
     "license": "MIT",
     "keywords": [

src/Protocol.php

@@ -22,7 +22,7 @@ final class Protocol
     /**
      * @var string Package version. Independent of the platform and connector versions.
      */
-    public const VERSION = '1.8.0';
+    public const VERSION = '1.8.1';
 
     /**
      * @var string Prefix on the canonical string a connector signs.