---
# nuzlocke-tracker-mn8d
title: 'Pin GitHub Actions to SHA hashes and add persist-credentials: false'
status: completed
type: task
priority: normal
created_at: 2026-02-16T19:13:49Z
updated_at: 2026-02-16T19:24:15Z
parent: nuzlocke-tracker-a5es
---

All GitHub Actions use tag references (@v4, @v5) instead of SHA hashes with version comments. Also missing persist-credentials: false on checkout steps.

## Checklist
- [ ] Pin actions/checkout to SHA with version comment
- [ ] Pin actions/setup-python to SHA with version comment
- [ ] Pin actions/setup-node to SHA with version comment
- [ ] Add persist-credentials: false to all checkout steps