From 1e7c556a3d866f52d14b487ec3ba58b504a4b838 Mon Sep 17 00:00:00 2001
From: WaterPancake <dmerino120@gmail.com>
Date: Sun, 18 Oct 2026 13:04:11 -0400
Subject: [PATCH] Pin CI actions to Node 24 releases by commit SHA

actions/checkout v4 -> v7.0.1 and astral-sh/setup-uv v5 -> v10.3.0, removing the Node 20 deprecation warning. setup-uv stopped publishing major tags at v8, so both are pinned by SHA.
---
 .github/workflows/test.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index de6687d..61a93e9 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -26,10 +26,11 @@ jobs:
     env:
       ABVID_TEST_ENV: ${{ matrix.extra }}
     steps:
-      - uses: actions/checkout@v4
+      # Actions are pinned by commit SHA (setup-uv no longer publishes major tags).
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           python-version: "3.11"