From dd2ccf9910c9f431c0717ce5f2e335fcf8c23b28 Mon Sep 17 00:00:00 2001
From: Santiago Quiroga <santiquiroga@google.com>
Date: Fri, 31 Jul 2026 11:38:41 -0700
Subject: [PATCH 1/8] ci(workflows): add librarian generation check presubmit

Modifications to librarian configuration and generator scripts require downstream generated code to be kept in sync with upstream changes.

Adds .github/workflows/generation_check.yaml to run on pull requests that modify librarian.yaml, .readme-partials.yaml, librarian.js, or librarian.ts, as well as on main branch pushes and workflow_dispatch events. The workflow sets up Node.js 22, pins googleapis/librarian to an immutable commit SHA (passing zizmor security checks), installs Librarian dependencies, executes librarian generate --all across configured packages, and asserts zero uncommitted git diffs exist.

Fixes googleapis/librarian#5352
---
 .github/workflows/generation_check.yaml | 56 +++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 .github/workflows/generation_check.yaml

diff --git a/.github/workflows/generation_check.yaml b/.github/workflows/generation_check.yaml
new file mode 100644
index 00000000000..d602599b898
--- /dev/null
+++ b/.github/workflows/generation_check.yaml
@@ -0,0 +1,56 @@
+name: generation-check
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  regeneration:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v3.0.2
+        id: changes
+        with:
+          filters: |
+            librarian:
+              - 'librarian.yaml'
+              - '.readme-partials.yaml'
+              - '**/librarian.js'
+              - '**/librarian.ts'
+
+      - name: Setup Node.js
+        if: steps.changes.outputs.librarian == 'true' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+
+      - uses: googleapis/librarian@a02c28273b3c9ddb33bbe5849a44b6a678d28404 # v0.27.1
+        if: steps.changes.outputs.librarian == 'true' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
+
+      - name: Install tools
+        if: steps.changes.outputs.librarian == 'true' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
+        run: librarian install
+
+      - name: Regenerate and Assert Clean Git Tree
+        if: steps.changes.outputs.librarian == 'true' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
+        run: |
+          librarian generate --all
+          if [ -n "$(git status --porcelain)" ]; then
+            git status
+            echo "==================== GIT DIFF ===================="
+            git add -N .
+            git diff
+            echo "=================================================="
+            echo "Regeneration failed. Please run 'librarian generate --all' locally to update generated files."
+            exit 1
+          fi

From 4e2d2ee2d8eae3e73664462a3493a2c277f45926 Mon Sep 17 00:00:00 2001
From: Santiago Quiroga <santiquiroga@google.com>
Date: Fri, 31 Jul 2026 12:52:44 -0700
Subject: [PATCH 2/8] fix(ci): pin librarian action to v0.31.1 matching
 librarian.yaml

Updates googleapis/librarian action SHA pin to 35997441eafc2b02716804f9baba1e3f04f8a44f corresponding to tag v0.31.1, aligning the action version with the version specified in librarian.yaml.
---
 .github/workflows/generation_check.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/generation_check.yaml b/.github/workflows/generation_check.yaml
index d602599b898..73540ae6c2a 100644
--- a/.github/workflows/generation_check.yaml
+++ b/.github/workflows/generation_check.yaml
@@ -34,7 +34,7 @@ jobs:
         with:
           node-version: 22
 
-      - uses: googleapis/librarian@a02c28273b3c9ddb33bbe5849a44b6a678d28404 # v0.27.1
+      - uses: googleapis/librarian@35997441eafc2b02716804f9baba1e3f04f8a44f # v0.31.1
         if: steps.changes.outputs.librarian == 'true' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
 
       - name: Install tools

From 6c4c5c10c83b083b27aaf39630a0133ed5c633d1 Mon Sep 17 00:00:00 2001
From: Santiago Quiroga <santiquiroga@google.com>
Date: Fri, 31 Jul 2026 13:09:52 -0700
Subject: [PATCH 3/8] ci(workflows): add librarian_tidy and align
 generation_check with Go workflow model

Adds .github/workflows/librarian_tidy.yml to verify that librarian.yaml is tidy on pull requests. Updates .github/workflows/generation_check.yaml to match the established google-cloud-go workflow pattern, using googleapis/librarian@main and adding automated main branch failure reporting via create-issue-on-failure.
---
 .github/workflows/generation_check.yaml | 43 ++++++++++++-------------
 .github/workflows/librarian_tidy.yml    | 42 ++++++++++++++++++++++++
 2 files changed, 63 insertions(+), 22 deletions(-)
 create mode 100644 .github/workflows/librarian_tidy.yml

diff --git a/.github/workflows/generation_check.yaml b/.github/workflows/generation_check.yaml
index 73540ae6c2a..50f3cb79e8d 100644
--- a/.github/workflows/generation_check.yaml
+++ b/.github/workflows/generation_check.yaml
@@ -1,56 +1,55 @@
+---
 name: generation-check
-
 on:
   push:
     branches:
       - main
   pull_request:
+  # Allows manual triggering for debugging purpose.
   workflow_dispatch:
-
 permissions:
   contents: read
-
+  issues: write
 jobs:
   regeneration:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4.2.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
-
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v3.0.2
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: changes
         with:
           filters: |
             librarian:
               - 'librarian.yaml'
-              - '.readme-partials.yaml'
-              - '**/librarian.js'
-              - '**/librarian.ts'
-
-      - name: Setup Node.js
+      # Version of librarian is pulled from librarian.yaml,
+      # main corresponds to the action's source definition.
+      - uses: googleapis/librarian@main # zizmor: ignore[unpinned-uses]
         if: steps.changes.outputs.librarian == 'true' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 22
-
-      - uses: googleapis/librarian@35997441eafc2b02716804f9baba1e3f04f8a44f # v0.31.1
-        if: steps.changes.outputs.librarian == 'true' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
-
       - name: Install tools
         if: steps.changes.outputs.librarian == 'true' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
         run: librarian install
-
-      - name: Regenerate and Assert Clean Git Tree
+      - name: Regenerate
         if: steps.changes.outputs.librarian == 'true' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
         run: |
           librarian generate --all
           if [ -n "$(git status --porcelain)" ]; then
             git status
             echo "==================== GIT DIFF ===================="
-            git add -N .
             git diff
             echo "=================================================="
-            echo "Regeneration failed. Please run 'librarian generate --all' locally to update generated files."
+            echo "Regeneration failed. Please run 'librarian generate --all' to update the generated files."
             exit 1
           fi
+      - name: Create issue if previous step fails
+        if: ${{ failure() && github.ref == 'refs/heads/main' }}
+        uses: googleapis/librarian/.github/actions/create-issue-on-failure@main # zizmor: ignore[unpinned-uses]
+        with:
+          title: "Librarian generate diff check failed on main branch"
+          body: |
+            The librarian generate diff check failed on main branch.
+
+            To keep the `main` branch healthy, please consider **reverting the triggering change** first. Once the revert is merged, you can investigate the failure and submit a new PR with the fix.
+
+            Please check the logs: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
diff --git a/.github/workflows/librarian_tidy.yml b/.github/workflows/librarian_tidy.yml
new file mode 100644
index 00000000000..19a56d199d5
--- /dev/null
+++ b/.github/workflows/librarian_tidy.yml
@@ -0,0 +1,42 @@
+name: librarian tidy
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  tidy-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        id: changes
+        with:
+          filters: |
+            librarian:
+              - 'librarian.yaml'
+      # Version of librarian is pulled from librarian.yaml,
+      # main corresponds to the action's source definition.
+      - uses: googleapis/librarian@main # zizmor: ignore[unpinned-uses]
+
+      - name: Run librarian tidy
+        if: steps.changes.outputs.librarian == 'true'
+        run: librarian tidy
+
+      - name: Check for diff
+        if: steps.changes.outputs.librarian == 'true'
+        run: |
+          if ! git diff --exit-code; then
+            V=$(librarian config get version 2>/dev/null || echo "latest")
+            echo "librarian.yaml is not tidy. Please run:"
+            echo ""
+            echo "  librarian tidy"
+            echo ""
+            echo "to tidy librarian.yaml and commit the changes."
+            exit 1
+          fi

From 9ade8f66126d450176c527a3f99eae64cafc75a3 Mon Sep 17 00:00:00 2001
From: Santiago Quiroga <santiquiroga@google.com>
Date: Fri, 31 Jul 2026 15:50:59 -0700
Subject: [PATCH 4/8] ci(workflows): pin librarian action SHAs to pass
 mandatory Zizmor checks

Pins googleapis/librarian and create-issue-on-failure actions to commit SHA a02c28273b3c9ddb33bbe5849a44b6a678d28404 (v0.31.1) across generation_check.yaml and librarian_tidy.yml.

This satisfies Alphabet's mandatory Zizmor security scanning policy requiring immutable commit SHA references for third-party actions, while allowing librarian.yaml to dynamically control CLI binary execution.
---
 .github/workflows/generation_check.yaml | 19 +++++++++++++++----
 .github/workflows/librarian_tidy.yml    |  9 +++++++--
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/generation_check.yaml b/.github/workflows/generation_check.yaml
index 50f3cb79e8d..48165bb1fc7 100644
--- a/.github/workflows/generation_check.yaml
+++ b/.github/workflows/generation_check.yaml
@@ -1,5 +1,6 @@
 ---
 name: generation-check
+
 on:
   push:
     branches:
@@ -7,12 +8,22 @@ on:
   pull_request:
   # Allows manual triggering for debugging purpose.
   workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
-  issues: write
+
 jobs:
   regeneration:
+    name: Regenerate and verify clean git tree
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # zizmor: ignore[undocumented-permissions] - Required for creating issue on main branch failure
+      issues: write
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
@@ -24,8 +35,8 @@ jobs:
             librarian:
               - 'librarian.yaml'
       # Version of librarian is pulled from librarian.yaml,
-      # main corresponds to the action's source definition.
-      - uses: googleapis/librarian@main # zizmor: ignore[unpinned-uses]
+      # action is pinned to commit SHA to satisfy blanket security policy.
+      - uses: googleapis/librarian@a02c28273b3c9ddb33bbe5849a44b6a678d28404 # v0.31.1
         if: steps.changes.outputs.librarian == 'true' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
       - name: Install tools
         if: steps.changes.outputs.librarian == 'true' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
@@ -44,7 +55,7 @@ jobs:
           fi
       - name: Create issue if previous step fails
         if: ${{ failure() && github.ref == 'refs/heads/main' }}
-        uses: googleapis/librarian/.github/actions/create-issue-on-failure@main # zizmor: ignore[unpinned-uses]
+        uses: googleapis/librarian/.github/actions/create-issue-on-failure@a02c28273b3c9ddb33bbe5849a44b6a678d28404 # v0.31.1
         with:
           title: "Librarian generate diff check failed on main branch"
           body: |
diff --git a/.github/workflows/librarian_tidy.yml b/.github/workflows/librarian_tidy.yml
index 19a56d199d5..583dab5834d 100644
--- a/.github/workflows/librarian_tidy.yml
+++ b/.github/workflows/librarian_tidy.yml
@@ -3,11 +3,16 @@ name: librarian tidy
 on:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   tidy-check:
+    name: Verify librarian.yaml is tidy
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -21,8 +26,8 @@ jobs:
             librarian:
               - 'librarian.yaml'
       # Version of librarian is pulled from librarian.yaml,
-      # main corresponds to the action's source definition.
-      - uses: googleapis/librarian@main # zizmor: ignore[unpinned-uses]
+      # action is pinned to commit SHA to satisfy blanket security policy.
+      - uses: googleapis/librarian@a02c28273b3c9ddb33bbe5849a44b6a678d28404 # v0.31.1
 
       - name: Run librarian tidy
         if: steps.changes.outputs.librarian == 'true'

From 4de2fd04735ed862292e8e9c599c48e4f86a12ee Mon Sep 17 00:00:00 2001
From: Santiago Quiroga <santiquiroga@google.com>
Date: Fri, 31 Jul 2026 16:03:17 -0700
Subject: [PATCH 5/8] ci(workflows): suppress excessive-permissions and refine
 concurrency for Zizmor

Suppresses excessive-permissions audit finding on job-level issues:write permission in generation_check.yaml. Updates concurrency grouping expressions across generation_check.yaml and librarian_tidy.yml to use pull_request.number to resolve Exit Code 13 findings.
---
 .github/workflows/generation_check.yaml | 4 ++--
 .github/workflows/librarian_tidy.yml    | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/generation_check.yaml b/.github/workflows/generation_check.yaml
index 48165bb1fc7..f07e1dae6f7 100644
--- a/.github/workflows/generation_check.yaml
+++ b/.github/workflows/generation_check.yaml
@@ -10,7 +10,7 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 permissions:
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      # zizmor: ignore[undocumented-permissions] - Required for creating issue on main branch failure
+      # zizmor: ignore[excessive-permissions,undocumented-permissions] - Required for creating issue on main branch failure
       issues: write
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
diff --git a/.github/workflows/librarian_tidy.yml b/.github/workflows/librarian_tidy.yml
index 583dab5834d..648ddcfccc1 100644
--- a/.github/workflows/librarian_tidy.yml
+++ b/.github/workflows/librarian_tidy.yml
@@ -4,7 +4,7 @@ on:
   pull_request:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 permissions:

From 2ce74915bc482a51358c9eb6cd2193c1f1fbd5bd Mon Sep 17 00:00:00 2001
From: Santiago Quiroga <santiquiroga@google.com>
Date: Fri, 31 Jul 2026 16:18:24 -0700
Subject: [PATCH 6/8] ci(workflows): add inline permission comments to pass
 Zizmor pedantic checks

Adds inline explanatory comments to contents: read and issues: write permission entries under jobs.regeneration in generation_check.yaml. This resolves Zizmor's undocumented-permissions audit finding.
---
 .github/workflows/generation_check.yaml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/generation_check.yaml b/.github/workflows/generation_check.yaml
index f07e1dae6f7..24e30f27686 100644
--- a/.github/workflows/generation_check.yaml
+++ b/.github/workflows/generation_check.yaml
@@ -14,16 +14,15 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
-  contents: read
+  contents: read # Read repository contents
 
 jobs:
   regeneration:
     name: Regenerate and verify clean git tree
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      # zizmor: ignore[excessive-permissions,undocumented-permissions] - Required for creating issue on main branch failure
-      issues: write
+      contents: read # Read repository contents
+      issues: write # Required for creating issue on main branch failure
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:

From 1aa522ce46286e5d8379ed26fcd26b07a8a33c35 Mon Sep 17 00:00:00 2001
From: Santiago Quiroga <santiquiroga@google.com>
Date: Fri, 31 Jul 2026 18:18:09 -0700
Subject: [PATCH 7/8] ci(workflows): correct action version comments to match
 release tags

Updates version comments for actions/checkout (v4.2.2) and dorny/paths-filter (v3.0.2) across generation_check.yaml and librarian_tidy.yml to resolve Zizmor ref-confusion findings.
---
 .github/workflows/generation_check.yaml | 4 ++--
 .github/workflows/librarian_tidy.yml    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/generation_check.yaml b/.github/workflows/generation_check.yaml
index 24e30f27686..9ea7a0542ef 100644
--- a/.github/workflows/generation_check.yaml
+++ b/.github/workflows/generation_check.yaml
@@ -24,10 +24,10 @@ jobs:
       contents: read # Read repository contents
       issues: write # Required for creating issue on main branch failure
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4.2.2
         with:
           persist-credentials: false
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v3.0.2
         id: changes
         with:
           filters: |
diff --git a/.github/workflows/librarian_tidy.yml b/.github/workflows/librarian_tidy.yml
index 648ddcfccc1..5e1313a239c 100644
--- a/.github/workflows/librarian_tidy.yml
+++ b/.github/workflows/librarian_tidy.yml
@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4.2.2
         with:
           persist-credentials: false
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v3.0.2
         id: changes
         with:
           filters: |

From 361ae1ff834253ce8e7e53ec37ad8485e57f4518 Mon Sep 17 00:00:00 2001
From: Santiago Quiroga <santiquiroga@google.com>
Date: Fri, 31 Jul 2026 19:02:51 -0700
Subject: [PATCH 8/8] ci(workflows): align action commit SHAs with exact
 release tag version comments

Resolves Zizmor ref-version-mismatch and stale-action-refs warnings by aligning actions/checkout to # v6.0.3, dorny/paths-filter to # v4.0.1, and pinning googleapis/librarian to commit 35997441eafc2b02716804f9baba1e3f04f8a44f corresponding to tag v0.31.1.
---
 .github/workflows/generation_check.yaml | 8 ++++----
 .github/workflows/librarian_tidy.yml    | 6 +++---
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/generation_check.yaml b/.github/workflows/generation_check.yaml
index 9ea7a0542ef..9e4a43b8560 100644
--- a/.github/workflows/generation_check.yaml
+++ b/.github/workflows/generation_check.yaml
@@ -24,10 +24,10 @@ jobs:
       contents: read # Read repository contents
       issues: write # Required for creating issue on main branch failure
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4.2.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v3.0.2
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: changes
         with:
           filters: |
@@ -35,7 +35,7 @@ jobs:
               - 'librarian.yaml'
       # Version of librarian is pulled from librarian.yaml,
       # action is pinned to commit SHA to satisfy blanket security policy.
-      - uses: googleapis/librarian@a02c28273b3c9ddb33bbe5849a44b6a678d28404 # v0.31.1
+      - uses: googleapis/librarian@35997441eafc2b02716804f9baba1e3f04f8a44f # v0.31.1
         if: steps.changes.outputs.librarian == 'true' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
       - name: Install tools
         if: steps.changes.outputs.librarian == 'true' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
@@ -54,7 +54,7 @@ jobs:
           fi
       - name: Create issue if previous step fails
         if: ${{ failure() && github.ref == 'refs/heads/main' }}
-        uses: googleapis/librarian/.github/actions/create-issue-on-failure@a02c28273b3c9ddb33bbe5849a44b6a678d28404 # v0.31.1
+        uses: googleapis/librarian/.github/actions/create-issue-on-failure@35997441eafc2b02716804f9baba1e3f04f8a44f # v0.31.1
         with:
           title: "Librarian generate diff check failed on main branch"
           body: |
diff --git a/.github/workflows/librarian_tidy.yml b/.github/workflows/librarian_tidy.yml
index 5e1313a239c..e830d1d3f18 100644
--- a/.github/workflows/librarian_tidy.yml
+++ b/.github/workflows/librarian_tidy.yml
@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4.2.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v3.0.2
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: changes
         with:
           filters: |
@@ -27,7 +27,7 @@ jobs:
               - 'librarian.yaml'
       # Version of librarian is pulled from librarian.yaml,
       # action is pinned to commit SHA to satisfy blanket security policy.
-      - uses: googleapis/librarian@a02c28273b3c9ddb33bbe5849a44b6a678d28404 # v0.31.1
+      - uses: googleapis/librarian@35997441eafc2b02716804f9baba1e3f04f8a44f # v0.31.1
 
       - name: Run librarian tidy
         if: steps.changes.outputs.librarian == 'true'