Addressing review comments

.github/workflows/eval-guidance.yml

@@ -18,14 +18,18 @@ jobs:
     if: "github.repository == 'google-gemini/gemini-cli'"
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@v4'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v4
         with:
           fetch-depth: 0
 
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4.4.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
       - name: 'Detect Steering Changes'
         id: 'detect'
-        env:
-          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
         run: |
           STEERING_DETECTED=$(node scripts/changed_prompt.js --steering-only)
           echo "STEERING_DETECTED=$STEERING_DETECTED" >> "$GITHUB_OUTPUT"
@@ -50,9 +54,9 @@ jobs:
 
       - name: 'Post Guidance Comment'
         if: "steps.detect.outputs.STEERING_DETECTED == 'true'"
-        uses: 'thollander/actions-comment-pull-request@v2'
+        uses: 'thollander/actions-comment-pull-request@65f9e5c9a1f2cd378bd74b2e057c9736982a8e74' # ratchet:thollander/actions-comment-pull-request@v3
         with:
-          comment_tag: 'eval-guidance-bot'
+          comment-tag: 'eval-guidance-bot'
           message: |
             ### 🧠 Model Steering Guidance