Pin Build workflow actions to commit SHAs

.github/workflows/build.yml

@@ -1,5 +1,8 @@
 name: Build
 
+# Actions are pinned to full commit SHAs (version in the trailing comment), like release.yml.
+# Update both the SHA and the comment together.
+
 on:
   push:
     branches: [main]
@@ -9,15 +12,15 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-java@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: '25'
           cache: maven
       - name: Build and test
         run: ./mvnw -B verify
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: AutoPickup
           path: target/AutoPickup-*.jar

CHANGELOG.md

@@ -6,7 +6,7 @@
 
 ### 變更
 
-- Release workflow 使用的 `actions/checkout`、`actions/setup-java` 改用完整的 commit SHA 固定版本（v7.0.1、v6.0.1），避免有 `contents: write` 權限的 workflow 因為上游 tag 被改動而執行到不同的程式碼。
+- 所有 GitHub Actions 改用完整的 commit SHA 固定版本：`actions/checkout` v7.0.1、`actions/setup-java` v6.0.1（Build 與 Release workflow）、`actions/upload-artifact` v7.0.2（Build workflow）。避免上游 tag 被改動時執行到不同的程式碼，Release workflow 有 `contents: write` 權限，這點尤其重要。
 
 ## [2.0.1] - 2026-10-09
 

CLAUDE.md

@@ -196,3 +196,4 @@ CI: `.github/workflows/build.yml` runs `./mvnw -B verify` on JDK 25 (Temurin) an
 7. **Event priority** — `BlockDropItemEvent` is handled at `HIGHEST` with `ignoreCancelled = true` so other plugins can cancel drops first.
 8. **Overflow drops use block world** — always call `dropLocation.getWorld()`, not `player.getWorld()`, to avoid cross-world item drops.
 9. **No new files without need** — prefer editing existing files; keep the package structure flat and minimal.
+10. **Pin GitHub Actions to commit SHAs** — write `uses: owner/action@<40-char SHA> # vX.Y.Z`, never a bare tag; resolve the SHA with `git ls-remote --tags https://github.com/owner/action` and update the SHA and the version comment together.