From 7b0d20b44a07b2303b2e7fc2bfca176ad322562f Mon Sep 17 00:00:00 2001
From: raphaelhagi <raphaelhagi@gmail.com>
Date: Thu, 6 Aug 2026 18:16:47 -0300
Subject: [PATCH 1/2] ci: migrate to approved-actions + add workflow
 permissions

---
 .github/workflows/spell-checking.yaml    |  9 ++++++---
 .github/workflows/sync-repositories.yaml | 11 +++++++----
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/spell-checking.yaml b/.github/workflows/spell-checking.yaml
index 0dee7b8..d463bba 100644
--- a/.github/workflows/spell-checking.yaml
+++ b/.github/workflows/spell-checking.yaml
@@ -11,14 +11,17 @@ on: # rebuild any PRs and main branch changes
         options: ['true', 'false']
         
 
+permissions:
+  contents: read
+
 jobs:
   spellcheck: # run the action
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: stone-payments/approved-actions/actions/checkout/v4@stable
 
       - name: Install Node
-        uses: actions/setup-node@v4
+        uses: stone-payments/approved-actions/actions/setup-node/v4@stable
         with:
           node-version: 18
       
@@ -26,7 +29,7 @@ jobs:
           cd .cspell 
           npm install
 
-      - uses: streetsidesoftware/cspell-action@v6
+      - uses: streetsidesoftware/cspell-action@v6 # approved-actions: nao encontrado no catalogo — revisao manual necessaria
         with:
           incremental_files_only: ${{ github.event.inputs.incremental_files_only }}
           config: "./cspell.json"
diff --git a/.github/workflows/sync-repositories.yaml b/.github/workflows/sync-repositories.yaml
index 10b94f3..6792b6c 100644
--- a/.github/workflows/sync-repositories.yaml
+++ b/.github/workflows/sync-repositories.yaml
@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   sync-repos:
     if: github.repository_owner == 'stone-payments'
@@ -29,7 +32,7 @@ jobs:
 
     - name: Generate GitHub App Token
       id: app-token-stone-payments
-      uses: actions/create-github-app-token@v1
+      uses: stone-payments/approved-actions/actions/create-github-app-token/v1@stable
       with:
         app-id: 996272
         private-key: ${{ secrets.GH_PRIVATE_KEY }}
@@ -37,14 +40,14 @@ jobs:
         repositories: ${{ env.REPO }}
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: stone-payments/approved-actions/actions/checkout/v4@stable
       with:
         token: ${{ steps.app-token-stone-payments.outputs.token }}
         path: "${{github.repository_owner}}-${{ env.REPO }}"
 
     - name: Generate GitHub App Token
       id: app-token
-      uses: actions/create-github-app-token@v1
+      uses: stone-payments/approved-actions/actions/create-github-app-token/v1@stable
       with:
         app-id: 996272
         private-key: ${{ secrets.GH_PRIVATE_KEY }}
@@ -52,7 +55,7 @@ jobs:
         repositories: ${{ env.REPO }}
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: stone-payments/approved-actions/actions/checkout/v4@stable
       with:
         token: ${{ steps.app-token.outputs.token }}
         repository: "${{ env.ORG }}/${{ env.REPO }}"

From 2e3f2b2c0241ce6cf4e013beca78ba147dc76090 Mon Sep 17 00:00:00 2001
From: Raphael Hagi <raphaelhagi@gmail.com>
Date: Thu, 6 Aug 2026 21:23:29 -0300
Subject: [PATCH 2/2] ci: migrate streetsidesoftware/cspell-action to
 approved-actions (v6 now in catalog)

---
 .github/workflows/spell-checking.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/spell-checking.yaml b/.github/workflows/spell-checking.yaml
index d463bba..f8e08c3 100644
--- a/.github/workflows/spell-checking.yaml
+++ b/.github/workflows/spell-checking.yaml
@@ -29,7 +29,7 @@ jobs:
           cd .cspell 
           npm install
 
-      - uses: streetsidesoftware/cspell-action@v6 # approved-actions: nao encontrado no catalogo — revisao manual necessaria
+      - uses: stone-payments/approved-actions/streetsidesoftware/cspell-action/v6@stable
         with:
           incremental_files_only: ${{ github.event.inputs.incremental_files_only }}
           config: "./cspell.json"