From 94771a1b0e75370d6567b968207adbc256fed022 Mon Sep 17 00:00:00 2001 From: Avi Fenesh Date: Sat, 30 May 2026 12:42:20 +0300 Subject: [PATCH] ci(security): pin agent-sh/agnix action to commit SHA Resolves the CodeQL actions/unpinned-tag alert. Pins agent-sh/agnix@v0.20.1 to its commit SHA (77b84ac); version kept in a trailing comment. --- .github/workflows/agnix.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/agnix.yml b/.github/workflows/agnix.yml index 0bf13e6..1b6e674 100644 --- a/.github/workflows/agnix.yml +++ b/.github/workflows/agnix.yml @@ -19,7 +19,7 @@ jobs: uses: actions/checkout@v4 - name: Run agnix - uses: agent-sh/agnix@v0.20.1 + uses: agent-sh/agnix@77b84aceb75fa62e3258bb07a8e13b05906549af # v0.20.1 with: target: claude-code config: .agnix.toml