[stephanbcbauer]

KIT Master Builder 🏗️ AI agent for Eclipse Tractus-X KITs · what is this? Posted through @stephanbcbauer's account at their request. I answer from the KITs, TRGs and files I opened, not from memory.

👋 Hi! I'm the KIT Master Builder — your Eclipse Tractus-X KIT architect.

Description

This PR pins the last thirteen GitHub Action references in this repository to full commit SHAs, in one commit, across three workflows. All other actions were already pinned.

Action	Before	After (SHA, exact release)	Lines
actions/checkout	@v7	3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1	5
actions/setup-go	@v7	b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0	1
actions/upload-artifact	@v7	cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2	2
Legion2/swagger-ui-action	@v1	eff65dc3f193f0a749872be82f74baa35be0797d # v1.3.0	1
jayanta525/github-pages-directory-listing	@v4.0.0	624ac8c4e56893256d3772f61a88e3b14d54314e # v4.0.0	2
peaceiris/actions-gh-pages	@v4	84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0	1
eclipse-tractusx/sig-infra/.github/actions/run-dash	@main	1a2be9d3b599c081a4a307d8124f33d209f7c54e # main	1

Files (all under .github/workflows/): publish_api.yaml (10), dash-licence-check.yaml (2), trufflehog.yml (1).

Why: a version tag or branch can point to a different commit at any time. That is how the March 2026 trivy-action supply-chain attack worked (GHSA-69fq-xp46-6x23). A commit SHA can't be moved, so the workflows always run exactly the code that was reviewed. That matters here because publish_api.yaml publishes the API hub to GitHub Pages.

For the tagged actions, each SHA is the commit the tag used so far points to today, so the behaviour does not change. The trailing comment names the exact release, so readers and Dependabot can see the version.

run-dash from sig-infra: sig-infra has no release tags yet, so I pinned today's main HEAD (1a2be9d3…, 2026-11-03), which already contains the latest run-dash change. Because there is no tag, Dependabot can't update this pin; updates have to be pulled in by hand until sig-infra publishes releases. The same approach is used in eclipse-tractusx/sig-release#1789.

Notes for review:

• trufflehog.yml and dash-licence-check.yaml run on pull requests, so CI on this PR exercises the pins there. publish_api.yaml runs on a schedule or manual dispatch.
• The open Dependabot PR chore(deps): bump trufflesecurity/trufflehog from 3.95.2 to 3.95.9 #64 (TruffleHog bump) touches a different, already pinned line in trufflehog.yml and does not conflict with this change.

Pre-review checks

• DEPENDENCIES are up-to-date. No library dependencies change; only CI action references are pinned.
• Copyright and license header are present on all affected files. Unchanged, since only uses: lines are edited.

---

Thanks for reviewing! 🏗️ Feel free to ask me anything in the comments.

How I checked this (and how you can reproduce it)

Checked against main @ cf51ffe:

# no branch/tag reference left in the workflows (prints nothing on this branch)
grep -rnE '^\s*-?\s*uses\s*:' .github/workflows | grep -vE '@[0-9a-f]{40}'
gh api repos/actions/checkout/commits/v7 --jq .sha
gh api repos/Legion2/swagger-ui-action/commits/v1 --jq .sha
gh api repos/eclipse-tractusx/sig-infra/commits/main --jq .sha

What I verified and what I only infer: I verified that every tag resolves to the pinned SHA (moving tag and exact release on the same commit), that 1a2be9d3… is the current sig-infra main HEAD, and that the branch diff contains exactly these thirteen uses: lines in one commit. I infer that the workflows behave the same; the PR checks confirm it for the PR-triggered workflows.

— KIT Master Builder 🏗️

[jSchuetz88]

Checked all references. LGTM.

In the cases where the reference was also slightly updated we need to check after merge, whether it still works as intended,