chore(deps): pin dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
Gigadrive/lupe	action	pinDigest	→ c80a4dd
actions/checkout	action	pinDigest	→ fbc6f39

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "after 02:00 and before 06:00 every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
lupe-docs	Ready	Preview, Comment	Jul 20, 2026 10:54pm

[coderabbitai]

📝 Walkthrough

Walkthrough

The .github/workflows/lupe.yml workflow's review job is updated to pin actions/checkout and Gigadrive/lupe/apps/action steps to specific commit SHAs, replacing the previous tag-based references (@v5 and @v0.2.0).

Changes

Workflow Action Pinning

Layer / File(s)	Summary
Pin actions to commit SHAs .github/workflows/lupe.yml	actions/checkout and Gigadrive/lupe/apps/action steps in the review job are pinned to specific commit SHAs instead of version tags.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related issues

• Dependency Dashboard #2: This PR's pinning of actions/checkout and Gigadrive/lupe/apps/action in the same workflow file directly addresses the Renovate-detected update targets referenced in this issue.

Possibly related PRs

• Gigadrive/lupe#25: Both PRs modify the same review job step referencing Gigadrive/lupe/apps/action in .github/workflows/lupe.yml.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: pinning dependencies to immutable SHAs.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/pin-dependencies

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/lupe.yml (1)

24-24: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Consider disabling credential persistence on checkout.

Static analysis flags this step for not setting persist-credentials: false. Since the job also runs a third-party action (Gigadrive/lupe/apps/action), leaving credentials persisted in the local git config is an unnecessary exposure if that action or any later step is compromised.

🔒 Suggested fix

       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 # default fetch-depth: 1 — the diff comes from the API, not git history
+        with:
+          persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/lupe.yml at line 24, The checkout step in the workflow
should stop persisting Git credentials to local config. Update the
actions/checkout usage in the lupe job to set persist-credentials to false, so
later steps like Gigadrive/lupe/apps/action do not inherit unnecessary
repository access. Keep the change confined to the checkout step and preserve
the existing fetch settings.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/lupe.yml:
- Line 24: The checkout step in the workflow should stop persisting Git
credentials to local config. Update the actions/checkout usage in the lupe job
to set persist-credentials to false, so later steps like
Gigadrive/lupe/apps/action do not inherit unnecessary repository access. Keep
the change confined to the checkout step and preserve the existing fetch
settings.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 76316c1d-85e0-46cb-a971-89e6b0aeb5af

📥 Commits

Reviewing files that changed from the base of the PR and between 5a8d1ce and 9ebf294.

📒 Files selected for processing (1)

• .github/workflows/lupe.yml