From c670529369516c8c284b18f7b552bae4e278d980 Mon Sep 17 00:00:00 2001
From: Alisa Novikova <62909685+alisa-alisa@users.noreply.github.com>
Date: Sun, 22 Mar 2026 22:20:14 -0700
Subject: [PATCH] Addressing review comments

---
 .github/workflows/eval-guidance.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/eval-guidance.yml b/.github/workflows/eval-guidance.yml
index 0c637e0d0c..e1f1ab3168 100644
--- a/.github/workflows/eval-guidance.yml
+++ b/.github/workflows/eval-guidance.yml
@@ -18,14 +18,18 @@ jobs:
     if: "github.repository == 'google-gemini/gemini-cli'"
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@v4'
+        uses: 'actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955' # ratchet:actions/checkout@v4
         with:
           fetch-depth: 0
 
+      - name: 'Set up Node.js'
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4.4.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
       - name: 'Detect Steering Changes'
         id: 'detect'
-        env:
-          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
         run: |
           STEERING_DETECTED=$(node scripts/changed_prompt.js --steering-only)
           echo "STEERING_DETECTED=$STEERING_DETECTED" >> "$GITHUB_OUTPUT"
@@ -50,9 +54,9 @@ jobs:
 
       - name: 'Post Guidance Comment'
         if: "steps.detect.outputs.STEERING_DETECTED == 'true'"
-        uses: 'thollander/actions-comment-pull-request@v2'
+        uses: 'thollander/actions-comment-pull-request@65f9e5c9a1f2cd378bd74b2e057c9736982a8e74' # ratchet:thollander/actions-comment-pull-request@v3
         with:
-          comment_tag: 'eval-guidance-bot'
+          comment-tag: 'eval-guidance-bot'
           message: |
             ### 🧠 Model Steering Guidance