Action pin sweep - an action is not pinned to a commit

[github-actions]

Actions that are not pinned to a commit

3 reference(s) need attention. Each one is new, or worse than what the reviewed backlog accepted.

repository	workflow	line	reference	why
ehr-integration-directory	ci.yml	21	actions/checkout@v4	not in the reviewed backlog (a tag is mutable by the upstream owner; a major tag moves by design)
ehr-integration-directory	ci.yml	22	actions/setup-node@v4	not in the reviewed backlog (a tag is mutable by the upstream owner; a major tag moves by design)
openadapt-attest-bench	ci.yml	117	actions/upload-artifact@v4	not in the reviewed backlog (a tag is mutable by the upstream owner; a major tag moves by design)

Pin each one to a full 40-character commit SHA, with the version in a trailing comment:

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

If a reference is deliberate for now, accept it explicitly:

python scripts/sweep_action_pins.py --write-baseline

Coverage

• Repositories read: 41 (non-archived, non-fork).
• Unpinned references in total: 120.
• Already in the reviewed backlog: 117 (not alerted on).

Produced by https://github.com/OpenAdaptAI/openadapt-ops/actions/runs/33413039598.