[DWS] SHA-pin GitHub Actions, and replace Snyk and Gitleaks with GitHub secret scanning

.github/SETUP_SECRETS.md

@@ -14,9 +14,6 @@ Your Nutrient DWS Processor API key for running integration tests.
 ### 2. NPM_TOKEN (Optional)
 Required only if you want to automatically publish to NPM.
 
-### 3. SNYK_TOKEN (Optional)
-Required only if you want to run Snyk security scans.
-
 ## How to Add Secrets
 
 1. Go to your repository on GitHub

.github/workflows/ci.yml

@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Use Node.js
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: '22.x'
         cache: 'npm'
@@ -32,10 +32,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Use Node.js
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: '22.x'
         cache: 'npm'
@@ -72,10 +72,10 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ matrix.node-version }}
         cache: 'npm'
@@ -91,10 +91,10 @@ jobs:
     needs: [lint-and-type-check, generated-types-drift, unit-tests]
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Use Node.js
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: '22.x'
         cache: 'npm'

.github/workflows/integration-tests.yml

@@ -16,10 +16,10 @@ jobs:
         node-version: [22.x, 24.x]
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ matrix.node-version }}
         cache: 'npm'

.github/workflows/scheduled-integration-tests.yml

@@ -13,10 +13,10 @@ jobs:
       NUTRIENT_API_KEY: ${{ secrets.NUTRIENT_API_KEY }}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Use Node.js
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: '22.x'
         cache: 'npm'
@@ -63,7 +63,7 @@ jobs:
 
     - name: Create issue if tests fail
       if: failure() && steps.test-run.outcome == 'failure'
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
           const date = new Date().toISOString().split('T')[0];
@@ -104,7 +104,7 @@ jobs:
           }
 
     - name: Upload test artifacts
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: always()
       with:
         name: scheduled-integration-results-${{ github.run_number }}
@@ -115,7 +115,7 @@ jobs:
 
     - name: Notify on success after previous failure
       if: success() && steps.test-run.outcome == 'success'
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
           // Close any open integration failure issues

.github/workflows/security.yml

@@ -9,23 +9,16 @@ on:
     - cron: '0 0 * * 0'  # Weekly on Sunday
 
 jobs:
+  # Broad credential detection is handled by GitHub secret scanning and push
+  # protection, which run on the repository itself. This job only covers the
+  # Nutrient-specific key formats that are not partner patterns.
   secret-scanning:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      security-events: write
 
     steps:
-    - uses: actions/checkout@v7
-      with:
-        fetch-depth: 0
-
-    - name: Run Gitleaks
-      uses: gitleaks/gitleaks-action@v3
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
-      continue-on-error: true
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Check for hardcoded secrets
       run: |
@@ -55,10 +48,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Use Node.js
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: '22.x'
         cache: 'npm'
@@ -71,12 +64,3 @@ jobs:
         echo "🔍 Running npm audit..."
         npm audit --production --audit-level=moderate || echo "⚠️ Audit found issues but continuing..."
       continue-on-error: true
-
-    - name: Run Snyk Security Scan
-      uses: snyk/actions/node@master
-      continue-on-error: true
-      env:
-        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-      with:
-        args: --severity-threshold=high
-      if: env.SNYK_TOKEN != ''

CHANGELOG.md

@@ -78,9 +78,7 @@ server's contract; the fifth raises the minimum Node.js version to 22. See
   removes the flag, and it was already redundant under flat config — file
   coverage is unchanged at 31 files.
 - Updated GitHub Actions: `checkout`, `setup-node` and `upload-artifact` to
-  v7, `github-script` to v9, and `gitleaks-action` v2 → v3. The
-  `gitleaks-action` bump is not optional — v2 runs on the Node 20 Actions
-  runtime, which GitHub removes from hosted runners on 2026-09-16.
+  v7, and `github-script` to v9.
 - `npm run typecheck` now also typechecks the test suite. Test files were
   excluded from the only project `tsc --noEmit` ran against, so they were
   never typechecked outside of `ts-jest` at test time.