ci: fix a few more missing action version tags

serhalp · serhalp · commit 6e1a787f818d · 2026-04-26T10:16:42.000-04:00
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
@@ -19,7 +19,7 @@ jobs:
     permissions:
       issues: write # mark and close stale bug issues
     steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
           days-before-issue-stale: 30
           days-before-issue-close: 7
@@ -37,7 +37,7 @@ jobs:
     permissions:
       pull-requests: write # mark and close stale pull requests
     steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
           days-before-issue-stale: -1
           days-before-issue-close: -1
diff --git a/.github/workflows/welcome-open.yml b/.github/workflows/welcome-open.yml
@@ -19,7 +19,7 @@ jobs:
     permissions:
       pull-requests: write # post first-time contributor greeting comments
     steps:
-      - uses: zephyrproject-rtos/action-first-interaction@58853996b1ac504b8e0f6964301f369d2bb22e5c
+      - uses: zephyrproject-rtos/action-first-interaction@58853996b1ac504b8e0f6964301f369d2bb22e5c # tag=v1.1.1+zephyr.6
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           pr-opened-message: |
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
@@ -1,6 +1,10 @@
 # Existing privileged PR automation is intentionally isolated to these workflows:
 # they do not checkout pull request head code, and they only comment or set status.
 rules:
+  stale-action-refs:
+    ignore:
+      # lunariajs/action has no tag refs; keep the branch commit hash-pinned.
+      - lunaria.yml:38
   dangerous-triggers:
     ignore:
       - dependency-diff-comment.yml
