[stephanbcbauer]

KIT Master Builder 🏗️ AI agent for Eclipse Tractus-X KITs · what is this? Posted through @stephanbcbauer's account at their request. I answer from the KITs, TRGs and files I opened, not from memory.

👋 Hi! I'm the KIT Master Builder — your Eclipse Tractus-X KIT architect.

Description

This PR pins the remaining twenty-nine GitHub Action references in this repository to full commit SHAs, in one commit, across seven workflows and the mxd-test-action composite action. All other actions were already pinned.

Action	Before	After (SHA, exact release)	Lines
actions/checkout	@v4	11d5960a326750d5838078e36cf38b85af677262 # v4.4.0	10
actions/setup-java	@v4	cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1	4
actions/stale	@v9	5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0	4
actions/setup-node	@v4	49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0	2
actions/setup-node	@v3	3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1	1
hashicorp/setup-terraform	@v3	b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2	2
peaceiris/actions-gh-pages	@v4	84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0	1
azure/setup-helm	@v4	1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1	1
azure/setup-kubectl	@v4	776406bce94f63e41d621b960d78ee25c8b76ede # v4.0.1	1
helm/kind-action	@v1.10.0	0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0	1
trufflesecurity/trufflehog	@main	ea68ca03c865c5f324e86e849ced20ed3cf9dbbb # v3.99.8	1
eclipse-tractusx/sig-infra/.github/actions/run-dash	@main	1a2be9d3b599c081a4a307d8124f33d209f7c54e # main	1

Files: .github/actions/mxd-test-action/action.yml (1) and, under .github/workflows/, run-end2end-tests.yml (6), run-tests.yaml (6), stale-bot.yml (4), verify-playground.yml (4), publish-playground.yaml (3), verify.yaml (3), secrets-scan.yml (2).

Why: a version tag or branch can point to a different commit at any time. That is how the March 2026 trivy-action supply-chain attack worked (GHSA-69fq-xp46-6x23). A commit SHA can't be moved, so the workflows always run exactly the code that was reviewed. That matters here because publish-playground.yaml deploys the policy playground to GitHub Pages.

For the tagged actions, each SHA is the commit the tag used so far points to today, so the behaviour does not change. The trailing comment names the exact release, so readers and Dependabot can see the version.

Two references that were branches:

• trufflehog@main in secrets-scan.yml: a moving branch is exactly the risk this PR removes, and doubly so for a secret scanner. I pinned the latest release, v3.99.8, so Dependabot can keep it up to date. The scan now runs the released code instead of whatever is on main at the time.
• run-dash from sig-infra: sig-infra has no release tags yet, so I pinned today's main HEAD (1a2be9d3…). Because there is no tag, Dependabot can't update this pin; updates have to be pulled in by hand. chore(actions): migrate from dedicated version to sha sig-infra#583 pins the actions inside sig-infra itself; once it is merged, this pin can be bumped.

Notes for review:

• run-tests.yaml, secrets-scan.yml, verify-playground.yml and verify.yaml run on pull requests, so CI on this PR exercises those pins, including the TruffleHog release. run-end2end-tests.yml runs after other workflows or on dispatch, publish-playground.yaml on push and stale-bot.yml on schedule.
• There are no open PRs that touch the workflows.

Pre-review checks

• DEPENDENCIES are up-to-date. No library dependencies change; only CI action references are pinned.
• Copyright and license header are present on all affected files. Unchanged, since only uses: lines are edited.

---

Thanks for reviewing! 🏗️ Feel free to ask me anything in the comments.

How I checked this (and how you can reproduce it)

Checked against main @ 03c4b3f:

# no branch/tag reference left in workflows/actions (prints nothing on this branch)
grep -rnE '^\s*-?\s*uses\s*:' .github --include='*.y*ml' | grep -vE '@[0-9a-f]{40}'
gh api repos/actions/checkout/commits/v4 --jq .sha
gh api repos/trufflesecurity/trufflehog/releases/latest --jq .tag_name
gh api repos/eclipse-tractusx/sig-infra/commits/main --jq .sha

What I verified and what I only infer: I verified that every tag resolves to the pinned SHA, that v3.99.8 is the latest TruffleHog release, that 1a2be9d3… is the current sig-infra main HEAD, and that the branch diff contains exactly these twenty-nine uses: lines in one commit. I infer that the workflows behave the same; the PR checks confirm it for the PR-triggered workflows.

— KIT Master Builder 🏗️