From 11c42b015a3cdb0f9a548f4bbcb59aec81c0a542 Mon Sep 17 00:00:00 2001
From: Brian Cole <brian.cole@opensesame.com>
Date: Wed, 2 Sep 2026 08:09:17 -0700
Subject: [PATCH 1/8] Bump GitHub Actions off deprecated Node 20 runtime
 (CORE-5974)

Pin the following to their latest Node 24 releases by commit SHA (with version comment): actions/checkout,actions/github-script,actions/setup-node,actions/upload-artifact,aws-actions/amazon-ecr-login,aws-actions/configure-aws-credentials,hashicorp/setup-terraform,mshick/add-pr-comment

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/deploy_feature_branch.yml            | 10 +++++-----
 .github/workflows/deploy_thru_prod.yml                 |  4 ++--
 .github/workflows/internal_on_merge_tag_versions.yml   |  4 ++--
 .../internal_on_pr_validate_component_version.yml      |  4 ++--
 .github/workflows/internal_on_push_ci.yml              |  4 ++--
 .github/workflows/run_semgrep_scan.yml                 |  8 ++++----
 .github/workflows/tf_apply.yml                         |  6 +++---
 .github/workflows/tf_validate_plan_single_root.yml     |  8 ++++----
 8 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/deploy_feature_branch.yml b/.github/workflows/deploy_feature_branch.yml
index 8e3ef08..2340f80 100644
--- a/.github/workflows/deploy_feature_branch.yml
+++ b/.github/workflows/deploy_feature_branch.yml
@@ -60,23 +60,23 @@ jobs:
           env: dev
           ORG_READ_ONLY_SSH_KEY: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
         with:
           role-to-assume: ${{ steps.get-role-arn.outputs.role-arn }}
           role-session-name: deployBranchDev-Run${{ inputs.role_session_name_suffix }}
           aws-region: ${{ steps.get-role-arn.outputs.region }}
 
       - name: Actions - Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20.x"
           registry-url: "https://npm.pkg.github.com"
 
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
           terraform_version: 1.6.3
           terraform_wrapper: false
@@ -84,7 +84,7 @@ jobs:
       - name: Login to Amazon ECR
         if: ${{ inputs.deploy_fargate }}
         id: login-ecr
-        uses: aws-actions/amazon-ecr-login@v1
+        uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2
 
       - name: Install IUM App Packages & Build App
         if: ${{ inputs.deploy_fargate }}
diff --git a/.github/workflows/deploy_thru_prod.yml b/.github/workflows/deploy_thru_prod.yml
index 61bb7a5..7658502 100644
--- a/.github/workflows/deploy_thru_prod.yml
+++ b/.github/workflows/deploy_thru_prod.yml
@@ -112,7 +112,7 @@ jobs:
 
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.commit-identifier }}
           fetch-depth: "0"
@@ -133,7 +133,7 @@ jobs:
       BUILD_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
 
     steps:
-      - uses: mshick/add-pr-comment@v2
+      - uses: mshick/add-pr-comment@ec328af66588ab8f77cdeb2c264f14aba45bbf59 # v3.12.0
         with:
           message: |
             # :page_with_curl: Status Report :page_with_curl:
diff --git a/.github/workflows/internal_on_merge_tag_versions.yml b/.github/workflows/internal_on_merge_tag_versions.yml
index aa62379..27f899c 100644
--- a/.github/workflows/internal_on_merge_tag_versions.yml
+++ b/.github/workflows/internal_on_merge_tag_versions.yml
@@ -24,10 +24,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
 
diff --git a/.github/workflows/internal_on_pr_validate_component_version.yml b/.github/workflows/internal_on_pr_validate_component_version.yml
index 22c6f92..0665e10 100644
--- a/.github/workflows/internal_on_pr_validate_component_version.yml
+++ b/.github/workflows/internal_on_pr_validate_component_version.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Get all labels from PR
         id: get_labels
@@ -46,7 +46,7 @@ jobs:
           echo "$all_labels" > all_labels.txt
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
 
diff --git a/.github/workflows/internal_on_push_ci.yml b/.github/workflows/internal_on_push_ci.yml
index 978b080..e7666b2 100644
--- a/.github/workflows/internal_on_push_ci.yml
+++ b/.github/workflows/internal_on_push_ci.yml
@@ -18,10 +18,10 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
 
diff --git a/.github/workflows/run_semgrep_scan.yml b/.github/workflows/run_semgrep_scan.yml
index 0fc97c5..16c2e29 100644
--- a/.github/workflows/run_semgrep_scan.yml
+++ b/.github/workflows/run_semgrep_scan.yml
@@ -138,7 +138,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.commit_identifier }}
           # Full history only when diff/baseline is requested
@@ -152,7 +152,7 @@ jobs:
           commit-identifier: ${{ inputs.commit_identifier }}
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
 
@@ -184,7 +184,7 @@ jobs:
 
       - name: Upload Artifact
         if: ${{ steps.semgrep.outputs.totalFindings > 0 }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: semgrep-${{ github.run_id }}.json
           path: semgrep_results.json
@@ -268,7 +268,7 @@ jobs:
       - name: Generate PR comment body
         if: ${{ github.event_name == 'pull_request' || steps.pr_check.outputs.pr_exists == 'true' }}
         id: generate_body
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_NUMBER: ${{ steps.pr_check.outputs.pr_number }}
           SCAN_STATUS: ${{ steps.semgrep.outputs.scanStatus }}
diff --git a/.github/workflows/tf_apply.yml b/.github/workflows/tf_apply.yml
index ba6d5c4..05ca363 100644
--- a/.github/workflows/tf_apply.yml
+++ b/.github/workflows/tf_apply.yml
@@ -84,14 +84,14 @@ jobs:
           env: ${{ inputs.environment }}
           ORG_READ_ONLY_SSH_KEY: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
         with:
           role-to-assume: ${{ steps.get-role-arn.outputs.role-arn }}
           role-session-name: ${{ inputs.terraform-workspace }}-${{ inputs.environment }}-Run${{ github.run_id }}
           aws-region: ${{ steps.get-role-arn.outputs.region }}
 
       - name: Checkout Actions
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.commit-identifier }}
 
@@ -106,7 +106,7 @@ jobs:
           chmod 600 ~/.ssh/id_rsa ~/.ssh/known_hosts
 
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
           terraform_version: ${{ inputs.terraform-version }}
           terraform_wrapper: false # required to access terraform outputs after apply
diff --git a/.github/workflows/tf_validate_plan_single_root.yml b/.github/workflows/tf_validate_plan_single_root.yml
index 836e3b0..26e2a10 100644
--- a/.github/workflows/tf_validate_plan_single_root.yml
+++ b/.github/workflows/tf_validate_plan_single_root.yml
@@ -79,14 +79,14 @@ jobs:
           env: ${{ inputs.environment }}
           ORG_READ_ONLY_SSH_KEY: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
         with:
           role-to-assume: ${{ steps.get-role-arn.outputs.role-arn }}
           role-session-name: ${{ inputs.terraform-workspace }}-${{ inputs.environment }}-Run${{ github.run_id }}
           aws-region: ${{ steps.get-role-arn.outputs.region }}
 
       - name: Checkout Actions
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.commit-identifier }}
 
@@ -101,7 +101,7 @@ jobs:
           chmod 600 ~/.ssh/id_rsa ~/.ssh/known_hosts
 
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
           terraform_version: ${{ inputs.terraform-version }}
           terraform_wrapper: false # required to access terraform outputs after apply
@@ -191,7 +191,7 @@ jobs:
       - name: Upload Plans to Artifact
         id: plan-artifact
         if: ${{ inputs.write-artifact }}
-        uses: actions/upload-artifact@v4.4.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{steps.set-plan-artifact-name.outputs.artifact_name}}
           path: terraform/${{ inputs.environment }}/tfplan.txt

From 1cf05ed4f3f875984f8b0b1e8dbdb1ce0302724a Mon Sep 17 00:00:00 2001
From: Brian Cole <brian.cole@opensesame.com>
Date: Wed, 2 Sep 2026 08:25:47 -0700
Subject: [PATCH 2/8] Bump/pin GitHub Actions and remove notify-slack-action
 (CORE-5974)

Second pass: SHA-pin all remaining action references (not just the ones
needing a Node 20 runtime bump), and remove the ravsamhq/notify-slack-action
step entirely per updated requirements (its latest upstream release still
runs on node20, so it was dropped rather than pinned).

Note: opensesame/core-github-actions and OpenSesame/core-github-actions
references that were tracking a mutable ref (main/legacy-stable) are now
frozen at their current commit - future updates to those branches will
no longer automatically propagate to this workflow.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/deploy_feature_branch.yml        | 6 +++---
 .github/workflows/deploy_thru_prod.yml             | 2 +-
 .github/workflows/run_semgrep_scan.yml             | 2 +-
 .github/workflows/tf_apply.yml                     | 2 +-
 .github/workflows/tf_validate_plan_single_root.yml | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/deploy_feature_branch.yml b/.github/workflows/deploy_feature_branch.yml
index 2340f80..3fa313a 100644
--- a/.github/workflows/deploy_feature_branch.yml
+++ b/.github/workflows/deploy_feature_branch.yml
@@ -54,7 +54,7 @@ jobs:
 
     steps:
       - id: get-role-arn
-        uses: OpenSesame/gha-oidc-access/get-role-arn@v2
+        uses: OpenSesame/gha-oidc-access/get-role-arn@1417c02442b956045a6930e271ce134faf8e09e6 # v2
         with:
           domain: ${{ inputs.oidc-domain }}
           env: dev
@@ -94,7 +94,7 @@ jobs:
           npm run build
 
       - name: Build And Apply Feature Branch to Dev
-        uses: opensesame/core-github-actions/build-apply@v1
+        uses: opensesame/core-github-actions/build-apply@50b11644cf5241af9f04368f38baf7b1eb02eb54 # v1
         id: build_apply
         with:
           github_ssh_key: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
@@ -131,7 +131,7 @@ jobs:
           aws ecs update-service --cluster $ECR_CLUSTER --service $ECS_SERVICE --force-new-deployment
 
       - name: Deploy to Dev
-        uses: opensesame/core-github-actions/deploy@v1
+        uses: opensesame/core-github-actions/deploy@50b11644cf5241af9f04368f38baf7b1eb02eb54 # v1
         with:
           github_ssh_key: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
           terraform_root: ${{ inputs.terraform-root }}
diff --git a/.github/workflows/deploy_thru_prod.yml b/.github/workflows/deploy_thru_prod.yml
index 7658502..194bace 100644
--- a/.github/workflows/deploy_thru_prod.yml
+++ b/.github/workflows/deploy_thru_prod.yml
@@ -118,7 +118,7 @@ jobs:
           fetch-depth: "0"
 
       - name: Create release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1
         with:
           tag: ${{ needs.Set-Release-Tag.outputs.release-tag }}
           commit: ${{ inputs.commit-identifier }}
diff --git a/.github/workflows/run_semgrep_scan.yml b/.github/workflows/run_semgrep_scan.yml
index 16c2e29..3ddf235 100644
--- a/.github/workflows/run_semgrep_scan.yml
+++ b/.github/workflows/run_semgrep_scan.yml
@@ -193,7 +193,7 @@ jobs:
 
       - name: Set up Reviewdog
         if: ${{ steps.semgrep.outputs.totalFindings > 0 }}
-        uses: reviewdog/action-setup@v1
+        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1
         with:
           reviewdog_version: v0.20.3
 
diff --git a/.github/workflows/tf_apply.yml b/.github/workflows/tf_apply.yml
index 05ca363..8d59865 100644
--- a/.github/workflows/tf_apply.yml
+++ b/.github/workflows/tf_apply.yml
@@ -78,7 +78,7 @@ jobs:
 
     steps:
       - id: get-role-arn
-        uses: OpenSesame/gha-oidc-access/get-role-arn@v2
+        uses: OpenSesame/gha-oidc-access/get-role-arn@1417c02442b956045a6930e271ce134faf8e09e6 # v2
         with:
           domain: ${{ inputs.oidc-domain }}
           env: ${{ inputs.environment }}
diff --git a/.github/workflows/tf_validate_plan_single_root.yml b/.github/workflows/tf_validate_plan_single_root.yml
index 26e2a10..0cbede3 100644
--- a/.github/workflows/tf_validate_plan_single_root.yml
+++ b/.github/workflows/tf_validate_plan_single_root.yml
@@ -73,7 +73,7 @@ jobs:
 
     steps:
       - id: get-role-arn
-        uses: OpenSesame/gha-oidc-access/get-role-arn@v2
+        uses: OpenSesame/gha-oidc-access/get-role-arn@1417c02442b956045a6930e271ce134faf8e09e6 # v2
         with:
           domain: ${{ inputs.oidc-domain }}
           env: ${{ inputs.environment }}

From f9b7c46b3f75d721c2490b944ca685052b97964f Mon Sep 17 00:00:00 2001
From: Brian Cole <brian.cole@opensesame.com>
Date: Wed, 2 Sep 2026 11:37:56 -0700
Subject: [PATCH 3/8] Fix Node 20 actions and pin internal action.yml refs
 (CORE-5974)

The earlier passes on this PR only touched .github/workflows/*.yml -
this repo also ships composite actions via top-level action.yml files
(both versioned components under .github/actions/ and legacy unversioned
ones at repo root) that are consumed directly by other repos. Those had
their own internal `uses:` steps that needed the same treatment:

- .github/actions/configure-aws-oidc/action.yml: pinned all three
  internal steps with version comments; bumped
  aws-actions/configure-aws-credentials v6.2.3 -> v6.2.4. The
  OpenSesame/gha-oidc-access/get-role-arn call is left on its existing
  commit (already 683 commits ahead of that repo's "v2" tag, which is
  stale/abandoned since 2023) rather than downgraded to match the v2
  pin used elsewhere in this rollout.
- .github/actions/upsert-pr-comment/action.yml: bumped
  actions/github-script v7 (node20) -> v9.0.0 (node24).
- semgrep/action.yml and tf-plan-comment/action.yml (legacy root-level
  composite actions, excluded from the versioning policy per
  VERSIONING.md): same actions/github-script bump, plus pinned
  reviewdog/action-setup by SHA.

Added CHANGELOG.md entries and version labels for the two affected
versioned components (configure-aws-oidc 1.0.1, upsert-pr-comment
1.0.1) and for run_semgrep_scan (1.0.2), per this repo's versioning
policy.

Note: six consumer repos already pinned
OpenSesame/core-github-actions/semgrep@main to this repo's current
main HEAD as part of this same rollout. That pin predates this fix
merging, so those six repos will NOT automatically pick up the
semgrep/action.yml fix - they'll need a follow-up SHA bump once this
PR merges.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/actions/configure-aws-oidc/CHANGELOG.md  | 8 ++++++++
 .github/actions/configure-aws-oidc/action.yml    | 6 +++---
 .github/actions/upsert-pr-comment/CHANGELOG.md   | 6 ++++++
 .github/actions/upsert-pr-comment/action.yml     | 2 +-
 .github/workflows/CHANGELOGS/run_semgrep_scan.md | 6 ++++++
 semgrep/action.yml                               | 4 ++--
 tf-plan-comment/action.yml                       | 2 +-
 7 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/.github/actions/configure-aws-oidc/CHANGELOG.md b/.github/actions/configure-aws-oidc/CHANGELOG.md
index 1959b5d..2b0c55b 100644
--- a/.github/actions/configure-aws-oidc/CHANGELOG.md
+++ b/.github/actions/configure-aws-oidc/CHANGELOG.md
@@ -2,6 +2,14 @@
 
 All notable changes to the `configure-aws-oidc` composite action are documented in this file.
 
+## 1.0.1
+
+### Changed
+
+- Pinned all internal `uses:` steps to commit SHAs with a version comment for auditability (CORE-5974).
+- Bumped `aws-actions/configure-aws-credentials` from `v6.2.3` to `v6.2.4`.
+- `OpenSesame/gha-oidc-access/get-role-arn` remains pinned to the same commit it already used (which is ahead of that repo's stale `v2` tag) — see PR notes.
+
 ## 1.0.0
 
 ### Added
diff --git a/.github/actions/configure-aws-oidc/action.yml b/.github/actions/configure-aws-oidc/action.yml
index 8d99fea..1792a94 100644
--- a/.github/actions/configure-aws-oidc/action.yml
+++ b/.github/actions/configure-aws-oidc/action.yml
@@ -37,7 +37,7 @@ runs:
   steps:
     - name: Create AWS role session name
       id: create-role-session-name
-      uses: OpenSesame/core-github-actions/.github/actions/create-aws-role-session-name@47e33e390ee69d31c498e32ba01f7e227b6ee864
+      uses: OpenSesame/core-github-actions/.github/actions/create-aws-role-session-name@47e33e390ee69d31c498e32ba01f7e227b6ee864 # actions/create-aws-role-session-name/1.0.0
       with:
         action: ${{ inputs.action }}
         environment: ${{ inputs.environment }}
@@ -46,14 +46,14 @@ runs:
 
     - name: Resolve AWS role
       id: get-role-arn
-      uses: OpenSesame/gha-oidc-access/get-role-arn@42e851ba54935047834bc50a3e2de800cc4952b9
+      uses: OpenSesame/gha-oidc-access/get-role-arn@42e851ba54935047834bc50a3e2de800cc4952b9 # main (2026-02-16) — ahead of the "v2" tag, which is stale (see PR notes)
       with:
         domain: ${{ inputs.domain }}
         env: ${{ inputs.environment }}
         ORG_READ_ONLY_SSH_KEY: ${{ inputs.ORG_READ_ONLY_SSH_KEY }}
 
     - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
+      uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
       with:
         role-to-assume: ${{ steps.get-role-arn.outputs.role-arn }}
         aws-region: ${{ steps.get-role-arn.outputs.region }}
diff --git a/.github/actions/upsert-pr-comment/CHANGELOG.md b/.github/actions/upsert-pr-comment/CHANGELOG.md
index e9b9dc1..b236d68 100644
--- a/.github/actions/upsert-pr-comment/CHANGELOG.md
+++ b/.github/actions/upsert-pr-comment/CHANGELOG.md
@@ -2,6 +2,12 @@
 
 All notable changes to the **upsert-pr-comment** action are documented in this file.
 
+## 1.0.1
+
+### Changed
+
+- Bumped `actions/github-script` from `v7` (Node 20, deprecated runtime) to `v9.0.0` (Node 24), pinned by commit SHA with a version comment (CORE-5974).
+
 ## 1.0.0
 
 ### Added
diff --git a/.github/actions/upsert-pr-comment/action.yml b/.github/actions/upsert-pr-comment/action.yml
index 702eba0..cf9b476 100644
--- a/.github/actions/upsert-pr-comment/action.yml
+++ b/.github/actions/upsert-pr-comment/action.yml
@@ -17,7 +17,7 @@ runs:
   using: composite
   steps:
     - name: Upsert PR summary comment
-      uses: actions/github-script@v7
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         PR_NUMBER: ${{ inputs.pr-number }}
         COMMENT_MARKER: ${{ inputs.comment-marker }}
diff --git a/.github/workflows/CHANGELOGS/run_semgrep_scan.md b/.github/workflows/CHANGELOGS/run_semgrep_scan.md
index 6a0e6bc..21c94ca 100644
--- a/.github/workflows/CHANGELOGS/run_semgrep_scan.md
+++ b/.github/workflows/CHANGELOGS/run_semgrep_scan.md
@@ -2,6 +2,12 @@
 
 All notable changes to the **run_semgrep_scan** callable workflow are documented in this file.
 
+## 1.0.2
+
+### Changed
+
+- Pinned `actions/checkout`, `actions/setup-node`, `actions/upload-artifact`, `reviewdog/action-setup`, and `actions/github-script` to Node 24-compatible releases by commit SHA (with version comments), addressing the GitHub Node 20 Actions runtime deprecation (CORE-5974).
+
 ## 1.0.1
 
 ### Changed
diff --git a/semgrep/action.yml b/semgrep/action.yml
index 0145b10..1d6775d 100644
--- a/semgrep/action.yml
+++ b/semgrep/action.yml
@@ -70,7 +70,7 @@ runs:
         fi
 
     - name: Set up Reviewdog
-      uses: reviewdog/action-setup@v1
+      uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1
       with:
         reviewdog_version: v0.20.3
 
@@ -161,7 +161,7 @@ runs:
 
     - name: Post success comment to PR
       if: github.event_name == 'pull_request' || github.event.pull_request
-      uses: actions/github-script@v7
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         github-token: ${{ inputs.github_token }}
         script: |
diff --git a/tf-plan-comment/action.yml b/tf-plan-comment/action.yml
index 40aab0c..b773321 100644
--- a/tf-plan-comment/action.yml
+++ b/tf-plan-comment/action.yml
@@ -12,7 +12,7 @@ runs:
   using: composite
   steps:
     - name: Upsert PR comment (Terraform plan)
-      uses: actions/github-script@v7
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
           const fs = require('fs');

From 46996dfd4b22ed469c4eef8f7c009525ed20f4ec Mon Sep 17 00:00:00 2001
From: Brian Cole <brian.cole@opensesame.com>
Date: Wed, 2 Sep 2026 12:00:23 -0700
Subject: [PATCH 4/8] remove unused action

---
 .github/workflows/deploy_feature_branch.yml | 138 --------------------
 1 file changed, 138 deletions(-)
 delete mode 100644 .github/workflows/deploy_feature_branch.yml

diff --git a/.github/workflows/deploy_feature_branch.yml b/.github/workflows/deploy_feature_branch.yml
deleted file mode 100644
index 3fa313a..0000000
--- a/.github/workflows/deploy_feature_branch.yml
+++ /dev/null
@@ -1,138 +0,0 @@
-name: "Deploy Feature Branch to Dev"
-
-on:
-  workflow_call:
-    inputs:
-      terraform_workspace:
-        description: 'Terraform workspace'
-        required: true
-        type: string
-      terraform-root:
-        description: 'Root directory of terraform dev. When omitted, terraform/dev is used'
-        required: false
-        type: string
-        default: 'terraform/dev'
-      oidc-domain:
-        description: 'OIDC Domain. Ex: "core" or "reveng"'
-        required: true
-        type: string
-      role_session_name_suffix:
-        description: 'Suffix for the role session name'
-        required: true
-        type: string
-      deploy_fargate:
-        description: 'Deploy Fargate'
-        required: false
-        default: false
-        type: boolean
-    secrets:
-      ORG_READ_ONLY_SSH_KEY:
-        required: true
-      ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN:
-        required: true
-
-    outputs:
-      name_prefix:
-        value: ${{ jobs.build_and_apply.outputs.name_prefix }}
-      api_endpoint:
-        value: ${{ jobs.build_and_apply.outputs.api_endpoint }}
-      deploy_fargate:
-        value: ${{ inputs.deploy_fargate }}
-
-permissions:
-  id-token: write
-  contents: read
-
-jobs:
-  build_and_apply:
-    runs-on: ubuntu-latest
-    environment: dev
-    outputs:
-      name_prefix: ${{ steps.build_apply.outputs.name_prefix }}
-      api_endpoint: ${{ steps.build_apply.outputs.api_endpoint }}
-      deploy_fargate: ${{ inputs.deploy_fargate }}
-
-    steps:
-      - id: get-role-arn
-        uses: OpenSesame/gha-oidc-access/get-role-arn@1417c02442b956045a6930e271ce134faf8e09e6 # v2
-        with:
-          domain: ${{ inputs.oidc-domain }}
-          env: dev
-          ORG_READ_ONLY_SSH_KEY: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
-
-      - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
-        with:
-          role-to-assume: ${{ steps.get-role-arn.outputs.role-arn }}
-          role-session-name: deployBranchDev-Run${{ inputs.role_session_name_suffix }}
-          aws-region: ${{ steps.get-role-arn.outputs.region }}
-
-      - name: Actions - Checkout Repo
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "20.x"
-          registry-url: "https://npm.pkg.github.com"
-
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
-        with:
-          terraform_version: 1.6.3
-          terraform_wrapper: false
-
-      - name: Login to Amazon ECR
-        if: ${{ inputs.deploy_fargate }}
-        id: login-ecr
-        uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2
-
-      - name: Install IUM App Packages & Build App
-        if: ${{ inputs.deploy_fargate }}
-        run: |
-          cd lambdas/user-management-api
-          npm ci
-          npm run build
-
-      - name: Build And Apply Feature Branch to Dev
-        uses: opensesame/core-github-actions/build-apply@50b11644cf5241af9f04368f38baf7b1eb02eb54 # v1
-        id: build_apply
-        with:
-          github_ssh_key: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
-          terraform_root: ${{ inputs.terraform-root }}
-          terraform_workspace: ${{ inputs.terraform_workspace }}
-          node_auth_token: ${{ secrets.ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN }}
-
-      - name: Get Feature Branch Prefix
-        if: ${{ inputs.deploy_fargate }}
-        id: get_branch_prefix
-        run: |
-          FEATURE_BRANCH_ENV=$(echo "${{ github.ref }}" | awk -F'/' '{print tolower($NF)}' | tr '_' '-' | cut -c 1-15 | sed 's/-*$//')
-          echo "FEATURE_BRANCH_ENV=$FEATURE_BRANCH_ENV" >> $GITHUB_ENV
-          echo "::set-output name=feature_branch_env::$FEATURE_BRANCH_ENV"
-
-      - name: Build, Tag, and Push IUM API Image to Dev ECR
-        if: ${{ inputs.deploy_fargate }}
-        env:
-          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
-          IMAGE_TAG: latest
-          ECR_REPOSITORY: ${{ env.FEATURE_BRANCH_ENV }}-ium-ecr-repository
-        run: |
-          cd lambdas/user-management-api
-          docker build -t $ECR_REPOSITORY:latest --platform linux/arm64 -f Dockerfile .
-          docker tag $ECR_REPOSITORY:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
-          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
-
-      - name: Update IUM ECS Service to use new image
-        if: ${{ inputs.deploy_fargate }}
-        env:
-          ECR_CLUSTER: ${{ env.FEATURE_BRANCH_ENV }}-ium-ecr-cluster
-          ECS_SERVICE: ${{ env.FEATURE_BRANCH_ENV }}-ium-ecs-service
-        run: |
-          aws ecs update-service --cluster $ECR_CLUSTER --service $ECS_SERVICE --force-new-deployment
-
-      - name: Deploy to Dev
-        uses: opensesame/core-github-actions/deploy@50b11644cf5241af9f04368f38baf7b1eb02eb54 # v1
-        with:
-          github_ssh_key: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
-          terraform_root: ${{ inputs.terraform-root }}
-          terraform_workspace: ${{ inputs.terraform_workspace }}

From 5a0561f144d75a902c25eb1d8b1915b7252c6f85 Mon Sep 17 00:00:00 2001
From: Brian Cole <brian.cole@opensesame.com>
Date: Wed, 2 Sep 2026 12:08:56 -0700
Subject: [PATCH 5/8] Fix moderate npm audit finding in @humanfs/node
 (pre-existing, unrelated to CORE-5974)

Bump @humanfs/node 0.16.7 -> 0.16.8 (transitive dev dependency via
eslint) to resolve GHSA-p498-v437-472g. package.json unchanged;
eslint stays pinned at 9.39.2. This was already present on main and
unrelated to the Node 20 Actions work, but included here since it
was blocking a green PR.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 package-lock.json | 28 +++++++++++++++++++++-------
 1 file changed, 21 insertions(+), 7 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 965755e..3aef33d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -826,29 +826,43 @@
       }
     },
     "node_modules/@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "dev": true,
       "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
       "engines": {
         "node": ">=18.18.0"
       }
     },
     "node_modules/@humanfs/node": {
-      "version": "0.16.7",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@humanfs/core": "^0.19.1",
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
         "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
         "node": ">=18.18.0"
       }
     },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",

From 2c127b58920f8b6d5b5155c25cb21279c301607d Mon Sep 17 00:00:00 2001
From: Brian Cole <brian.cole@opensesame.com>
Date: Wed, 2 Sep 2026 12:40:58 -0700
Subject: [PATCH 6/8] Fix imprecise version comments from CORE-5974 SHA-pinning
 pass

A couple of action references were pinned with a bare major-version tag
as the comment (e.g. "# v6") instead of the precise release the SHA
actually corresponds to (e.g. "# v6.1.0"). Caught by a Copilot review
comment on the core-github-actions PR; fixing the same root-cause issue
here since it was applied identically across this rollout.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/deploy_thru_prod.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy_thru_prod.yml b/.github/workflows/deploy_thru_prod.yml
index 194bace..6eae617 100644
--- a/.github/workflows/deploy_thru_prod.yml
+++ b/.github/workflows/deploy_thru_prod.yml
@@ -118,7 +118,7 @@ jobs:
           fetch-depth: "0"
 
       - name: Create release
-        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           tag: ${{ needs.Set-Release-Tag.outputs.release-tag }}
           commit: ${{ inputs.commit-identifier }}

From 3374d6d707fdd4c8650d413444d111338e93ab68 Mon Sep 17 00:00:00 2001
From: Brian Cole <brian.cole@opensesame.com>
Date: Wed, 2 Sep 2026 12:52:38 -0700
Subject: [PATCH 7/8] Fix reviewdog/action-setup version comment to v1.5.0

This was the actual Copilot-flagged finding - I had fixed it locally
in an earlier session but never committed/pushed it, so a later
cleanup pass (working from a fresh remote clone that didn't have this
uncommitted change) left the original imprecise "# v1" comment in
place. Correcting it now: the pinned SHA resolves to v1, v1.5, and
v1.5.0 simultaneously; v1.5.0 is the precise release.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/run_semgrep_scan.yml | 2 +-
 semgrep/action.yml                     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/run_semgrep_scan.yml b/.github/workflows/run_semgrep_scan.yml
index 3ddf235..ac5be25 100644
--- a/.github/workflows/run_semgrep_scan.yml
+++ b/.github/workflows/run_semgrep_scan.yml
@@ -193,7 +193,7 @@ jobs:
 
       - name: Set up Reviewdog
         if: ${{ steps.semgrep.outputs.totalFindings > 0 }}
-        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1
+        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1.5.0
         with:
           reviewdog_version: v0.20.3
 
diff --git a/semgrep/action.yml b/semgrep/action.yml
index 1d6775d..43e9bba 100644
--- a/semgrep/action.yml
+++ b/semgrep/action.yml
@@ -70,7 +70,7 @@ runs:
         fi
 
     - name: Set up Reviewdog
-      uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1
+      uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1.5.0
       with:
         reviewdog_version: v0.20.3
 

From 8f2e42bfcad641881776b2cdd4e4b55403fa038e Mon Sep 17 00:00:00 2001
From: Brian Cole <brian.cole@opensesame.com>
Date: Wed, 2 Sep 2026 13:02:20 -0700
Subject: [PATCH 8/8] fix version comment

---
 .github/actions/configure-aws-oidc/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/actions/configure-aws-oidc/action.yml b/.github/actions/configure-aws-oidc/action.yml
index 1792a94..56f1c69 100644
--- a/.github/actions/configure-aws-oidc/action.yml
+++ b/.github/actions/configure-aws-oidc/action.yml
@@ -46,7 +46,7 @@ runs:
 
     - name: Resolve AWS role
       id: get-role-arn
-      uses: OpenSesame/gha-oidc-access/get-role-arn@42e851ba54935047834bc50a3e2de800cc4952b9 # main (2026-02-16) — ahead of the "v2" tag, which is stale (see PR notes)
+      uses: OpenSesame/gha-oidc-access/get-role-arn@42e851ba54935047834bc50a3e2de800cc4952b9 # v2.0.2
       with:
         domain: ${{ inputs.domain }}
         env: ${{ inputs.environment }}