.github/workflows/callable-dependency-review.yaml

@@ -1,15 +1,6 @@
 name: Dependency Review
 on:
   workflow_call:
-    inputs:
-      allow-ghsas:
-        description: >-
-          Comma-separated GHSA IDs to exclude from failing the review.
-          Only for advisories already adjudicated as accepted risk in the
-          calling repo (documented in its .security-review/suppressions.json).
-        type: string
-        required: false
-        default: ''
 permissions:
   contents: read
 jobs:
@@ -20,4 +11,3 @@ jobs:
       - uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: high
-          allow-ghsas: ${{ inputs.allow-ghsas }}

.github/workflows/callable-labeler.yaml

@@ -130,7 +130,7 @@ jobs:
                     - '**/*_spec.rb'
                     - '**/*_test.rb'
           EOF
-      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13  # v7.0.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d  # v6
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: ${{ runner.temp }}/labeler.yml

.github/workflows/cd-cdk.yaml

@@ -94,7 +94,7 @@ jobs:
             pip install -r "$req"
           done
 
-      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6
+      - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}

.github/workflows/cd-mobile-ios.yaml

@@ -62,7 +62,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6
+      - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
@@ -73,7 +73,7 @@ jobs:
           cache: npm
           cache-dependency-path: ${{ inputs.cache-dependency-path }}
 
-      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
+      - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
         with:
           ruby-version: ${{ inputs.ruby-version }}
           bundler-cache: true

.github/workflows/cd-sam.yaml

@@ -48,7 +48,7 @@ jobs:
 
       - uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3
 
-      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6
+      - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}

.github/workflows/compliance-audit.yaml

@@ -76,7 +76,7 @@ jobs:
 
       - name: Run compliance audit
         id: audit
-        uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1
+        uses: anthropics/claude-code-action@af0559ee4f514d1ef21826982bed13f7edc3c35e # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: |