ci: pin actions to commit SHAs in check-wix-proxy.yml - #254

Claude finished @guyofeck's task —— View job

Review: PR #254 — Pin actions to SHAs in check-wix-proxy.yml

• Read changed workflow file
• Verify SHA pinning correctness
• Check for remaining unpinned actions
• Post review feedback

Verdict: LGTM — this is a correct, minimal fix. Approve-worthy (though I can't formally approve).

Correctness

• actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 — matches the exact SHA used by every other workflow in the repo (lint.yml, unit-tests.yml, security-audit.yml, preview-publish.yml, manual-publish.yml, claude*.yml, etc.). ✅ Consistent.
• actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 — this is the only Python-using workflow, so there's no in-repo peer to compare against, but the format is correct and the # v6 comment documents the tag. ✅

Scope check

The PR body's claim that no unpinned uses: remain holds for actual workflow steps. The remaining unpinned uses: matches from grep are all inside the Python checker/test scripts (.github/scripts/check_wix_proxy_steps.py, test_check_wix_proxy_steps.py) — those are YAML string fixtures used to test the proxy-step checker, not executed workflow steps, so they're correctly out of scope.

One pre-existing item (not introduced by this PR, just noting): .github/workflows/wix-gateway-proxy-check.yml:20 uses actions/checkout@3d3c42e5... without a # vN comment. It's SHA-pinned so it passes the policy, but for consistency it'd be nice to add the version comment in a future cleanup.

Security / best practices

• SHA pinning is exactly the right approach for supply-chain safety, and this brings the file in line with the repo's sha_pinning_required: true policy. ✅
• permissions: contents: read is appropriately minimal. ✅
• No performance or test-coverage concerns — this is a CI config fix.

Bugs

None found. The change directly resolves the startup_failure described in the PR body.
• Branch: ci/pin-check-wix-proxy-actions

🚀 Package Preview Available!

Install this PR's preview build with npm:

npm i @base44-preview/sdk@0.8.42-pr.254.6a358ec

Prefer not to change any import paths? Install using npm alias so your code still imports @base44/sdk:

npm i "@base44/sdk@npm:@base44-preview/sdk@0.8.42-pr.254.6a358ec"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "@base44/sdk": "npm:@base44-preview/sdk@0.8.42-pr.254.6a358ec"
  }
}

• 📦 Preview Package: @base44-preview/sdk@0.8.42-pr.254.6a358ec
• 🔗 View this commit on GitHub

_{Preview published to npm registry — try new features instantly!}