Merge pull request #261 from openai/codex/pin-github-workflow-refs-20260326-184341

Author: seratch

.github/workflows/ci.yml

@@ -27,9 +27,9 @@ jobs:
       (github.event_name == 'push' || github.event.pull_request.head.repo.fork) &&
       (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@c515ec17f69368147deb311832da000dd229d338 # v1
         with:
           bundler-cache: false
       - run: |-
@@ -40,7 +40,7 @@ jobs:
           github.repository == 'stainless-sdks/openai-ruby' &&
           !startsWith(github.ref, 'refs/heads/stl/')
         id: github-oidc
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: core.setOutput('github_token', await core.getIDToken());
 
@@ -61,9 +61,9 @@ jobs:
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@c515ec17f69368147deb311832da000dd229d338 # v1
         with:
           bundler-cache: false
       - run: |-
@@ -81,9 +81,9 @@ jobs:
       matrix:
         ruby-version: ['3.2', '3.3', '3.4', '4.0']
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@c515ec17f69368147deb311832da000dd229d338 # v1
         with:
           ruby-version: ${{ matrix.ruby-version }}
           bundler-cache: false

.github/workflows/create-releases.yml

@@ -16,17 +16,17 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - uses: stainless-api/trigger-release-please@v1
+      - uses: stainless-api/trigger-release-please@bb6677c5a04578eec1ccfd9e1913b5b78ed64c61 # v1
         id: release
         with:
           repo: ${{ github.event.repository.full_name }}
           stainless-api-key: ${{ secrets.STAINLESS_API_KEY }}
 
       - name: Set up Ruby
         if: ${{ steps.release.outputs.releases_created }}
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@c515ec17f69368147deb311832da000dd229d338 # v1
         with:
           bundler-cache: false
           ruby-version: '3.2'

.github/workflows/publish-gem.yml

@@ -10,9 +10,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@c515ec17f69368147deb311832da000dd229d338 # v1
         with:
           bundler-cache: false
       - run: |-

.github/workflows/release-doctor.yml

@@ -13,7 +13,7 @@ jobs:
     if: github.repository == 'openai/openai-ruby' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Check release environment
         run: |