From 7b3d4b64b527248a459776bb2c35f4828d9e0c44 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 9 Oct 2026 02:47:04 +0000
Subject: [PATCH] Pin Build workflow actions to commit SHAs

checkout v7.0.1 (3d3c42e), setup-java v6.0.1 (de7274f) and
upload-artifact v7.0.2 (cf430e0) - the commits the v7/v6/v7 tags point
to today, so behaviour is unchanged. Every action in .github/ is now
SHA-pinned; CLAUDE.md gains a rule to keep it that way.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018syaxkhsW9ioZChSmth9Xx
---
 .github/workflows/build.yml | 9 ++++++---
 CHANGELOG.md                | 2 +-
 CLAUDE.md                   | 1 +
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 42f0363..e33077a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,5 +1,8 @@
 name: Build
 
+# Actions are pinned to full commit SHAs (version in the trailing comment), like release.yml.
+# Update both the SHA and the comment together.
+
 on:
   push:
     branches: [main]
@@ -9,15 +12,15 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-java@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: '25'
           cache: maven
       - name: Build and test
         run: ./mvnw -B verify
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: AutoPickup
           path: target/AutoPickup-*.jar
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 99a68ec..6e05d63 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,7 @@
 
 ### 變更
 
-- Release workflow 使用的 `actions/checkout`、`actions/setup-java` 改用完整的 commit SHA 固定版本（v7.0.1、v6.0.1），避免有 `contents: write` 權限的 workflow 因為上游 tag 被改動而執行到不同的程式碼。
+- 所有 GitHub Actions 改用完整的 commit SHA 固定版本：`actions/checkout` v7.0.1、`actions/setup-java` v6.0.1（Build 與 Release workflow）、`actions/upload-artifact` v7.0.2（Build workflow）。避免上游 tag 被改動時執行到不同的程式碼，Release workflow 有 `contents: write` 權限，這點尤其重要。
 
 ## [2.0.1] - 2026-10-09
 
diff --git a/CLAUDE.md b/CLAUDE.md
index bd621ad..df4b616 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -196,3 +196,4 @@ CI: `.github/workflows/build.yml` runs `./mvnw -B verify` on JDK 25 (Temurin) an
 7. **Event priority** — `BlockDropItemEvent` is handled at `HIGHEST` with `ignoreCancelled = true` so other plugins can cancel drops first.
 8. **Overflow drops use block world** — always call `dropLocation.getWorld()`, not `player.getWorld()`, to avoid cross-world item drops.
 9. **No new files without need** — prefer editing existing files; keep the package structure flat and minimal.
+10. **Pin GitHub Actions to commit SHAs** — write `uses: owner/action@<40-char SHA> # vX.Y.Z`, never a bare tag; resolve the SHA with `git ls-remote --tags https://github.com/owner/action` and update the SHA and the version comment together.