[Salil Das (sadlilas)]

Summary

Pin the 3 remote GitHub Actions uses references in .github/workflows/tests.yml to verified full 40-character commit SHAs. Each pin retains its original version tag as an inline human-readable comment.

Changes

Original action reference	Pinned commit
actions/checkout@v4	11d5960a326750d5838078e36cf38b85af677262
actions/setup-python@v5	a26af69be951a213d495a4c3e4e4022e16d87065
astral-sh/setup-uv@v6	d0cc045d04ccac9d8b7881df0226f9e82c39688e

Only .github/workflows/tests.yml changes. Triggers, permissions, matrices, test commands, cache settings, and action inputs are preserved. Runtime source, tests, dependency declarations, and the committed lockfile are unchanged.

Baseline source: 941806a4a42c84c7c239fd8e0f8ef1260f1ec32f.

Validation

Local runs used macOS, uv 0.13.6, and Python 3.13.18. Test processes used isolated environments and a scratch home with no inherited provider credentials. Dependency installation used the existing lock without editing it.

Command	Exit	Result
uv sync --frozen --all-extras --dev	0	Committed lock installed in an isolated environment.
uv run --frozen --no-sync pytest tests -v	2	Collected 430 items; stopped with 2 collection errors and 1 skip. No full-suite pass is claimed.
uv run --frozen --no-sync pytest tests/test_stream_delay_default.py tests/test_typed_image_estimation.py -q	0	11 passed.
actionlint -color .github/workflows/tests.yml	0	actionlint 1.7.7; original baseline workflow also passed.
git diff --check	0	No whitespace errors.

Additional workflow verification passed:

• Parsed original and updated YAML, normalized only the canonical uses substitutions, and required complete document equality.
• Checked every changed line: only the exact remote ref and its original-tag comment changed.
• Inventoried all remote uses: 3 full-SHA pins, zero unpinned references.
• Confirmed every tracked non-workflow file remains byte-for-byte identical to the baseline and git refs are unchanged.

Baseline findings and limits

• The frozen-lock environment lacks amplifier_foundation, imported by tests/test_goal_loop.py; collection of tests/test_live_goal_lifecycle.py then also fails. A pristine export of baseline HEAD reproduced the same two errors and one skip (exit 2) using the same frozen environment.
• The lock resolves Core to 47fd2adf15cfc8a4552e1929f2154fdc91f5bb9a. The workflow intentionally installs current main sources, including foundation; that separate dependency-installation mode was not run because local validation was required to keep the existing frozen dependency set. This local baseline result is not a claim that the hosted workflow fails.
• No lint command is declared by this repository; an additional Python linter is N/A, not silently substituted.
• Initial dependency setup exceeded a 240-second build limit (exit 124); a bounded retry completed successfully (exit 0).

Scope and N/As

• Hosted runner execution and the complete OS/Python matrix: NOT RUN locally; the existing matrix is unchanged.
• Live model/provider testing and remote API writes: N/A to this workflow-only pinning change and outside scope.
• Runtime migrations, dependency upgrades, and new runtime tests: N/A; no runtime behavior or dependency version is changed.
• Formatting changes: N/A; the repository's existing lint policy is retained without adding a formatter gate.

No pre-existing issue was fixed or suppressed to make this pinning change appear green.