Pin GitHub Actions to commit SHAs

.github/workflows/bump-plugin-shas.yml

@@ -79,7 +79,7 @@ jobs:
           [[ "$DRY_RUN" = "true" ]] && args+=(--dry-run)
           python3 .github/scripts/discover_bumps.py "${args[@]}"
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 (sha-pinned)
         if: steps.existing.outputs.count == '0' && steps.discover.outputs.count != '0' && inputs.dry_run != true
 
       - name: Validate marketplace.json

.github/workflows/validate-frontmatter.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 (sha-pinned)
 
       - name: Install dependencies
         run: cd .github/scripts && bun install yaml

.github/workflows/validate-marketplace.yml

@@ -11,7 +11,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 (sha-pinned)
 
       - name: Validate marketplace.json
         run: bun .github/scripts/validate-marketplace.ts .claude-plugin/marketplace.json