From ee42b832d1696aa9f4c22d91bf2c9eb60eb85816 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 22 Jul 2026 14:28:52 +0000
Subject: [PATCH 1/2] Initial plan


From 6e8bd816eff793a06f0694dffeef64e0bd33d3d1 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 22 Jul 2026 14:34:39 +0000
Subject: [PATCH 2/2] fix: pin docker/build-push-action to commit SHA to
 resolve alert #625

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/workflows/publish-safe-outputs-node.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish-safe-outputs-node.yml b/.github/workflows/publish-safe-outputs-node.yml
index e391010fb1a..5dcd263ca31 100644
--- a/.github/workflows/publish-safe-outputs-node.yml
+++ b/.github/workflows/publish-safe-outputs-node.yml
@@ -190,7 +190,7 @@ jobs:
 
       - name: Build and push gh-aw-node
         if: steps.decision.outputs.should_push == 'true'
-        uses: docker/build-push-action@v7.2.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: actions/setup/js/Dockerfile.safe-outputs-mcp