From ce7fd1ef98f0cd4693c48eea4f24f4b1e2b8355d Mon Sep 17 00:00:00 2001
From: "Charlotte St. John" <cstjohn@twilio.com>
Date: Thu, 25 Jun 2026 18:24:39 -0500
Subject: [PATCH] ci: migrate runs-on to Twilio runner labels + SHA-pin actions

---
 .github/workflows/pr-lint.yml         |  4 ++--
 .github/workflows/test-and-deploy.yml | 20 ++++++++++----------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml
index 2f5232b..ddd8d04 100644
--- a/.github/workflows/pr-lint.yml
+++ b/.github/workflows/pr-lint.yml
@@ -6,9 +6,9 @@ on:
 jobs:
   validate:
     name: Validate title
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-large
     steps:
-      - uses: amannn/action-semantic-pull-request@v4
+      - uses: amannn/action-semantic-pull-request@505e44b4f33b4c801f063838b3f053990ee46ea7  # v4
         with:
           types: chore docs fix feat test misc
         env:
diff --git a/.github/workflows/test-and-deploy.yml b/.github/workflows/test-and-deploy.yml
index 05c62cb..1c47c3c 100644
--- a/.github/workflows/test-and-deploy.yml
+++ b/.github/workflows/test-and-deploy.yml
@@ -13,19 +13,19 @@ on:
 jobs:
   test:
     name: Test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-large
     timeout-minutes: 20
     strategy:
       matrix:
         ruby: [ '2.4', '2.5', '2.6', '2.7', '3.0', '3.1' ]
     steps:
       - name: Checkout ruby-http-client
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5  # v2
         with:
           fetch-depth: 0
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74  # v1
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
@@ -49,15 +49,15 @@ jobs:
     name: Deploy
     if: success() && github.ref_type == 'tag'
     needs: [ test ]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-large
     steps:
       - name: Checkout ruby-http-client
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5  # v2
         with:
           fetch-depth: 0
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74  # v1
         with:
           ruby-version: 3.1
           bundler-cache: true
@@ -65,7 +65,7 @@ jobs:
       - run: make install
 
       - name: Create GitHub Release
-        uses: sendgrid/dx-automator/actions/release@main
+        uses: sendgrid/dx-automator/actions/release@08b601b726671445abc798ed59881766ec8fefc6  # main
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -81,7 +81,7 @@ jobs:
           gem push *.gem
 
       - name: Submit metric to Datadog
-        uses: sendgrid/dx-automator/actions/datadog-release-metric@main
+        uses: sendgrid/dx-automator/actions/datadog-release-metric@08b601b726671445abc798ed59881766ec8fefc6  # main
         env:
           DD_API_KEY: ${{ secrets.DATADOG_API_KEY }}
 
@@ -89,9 +89,9 @@ jobs:
     name: Slack notify on failure
     if: failure() && github.event_name != 'pull_request' && (github.ref == 'refs/heads/main' || github.ref_type == 'tag')
     needs: [ test, deploy ]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-large
     steps:
-      - uses: rtCamp/action-slack-notify@v2
+      - uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # v2
         env:
           SLACK_COLOR: failure
           SLACK_ICON_EMOJI: ':github:'