fix: resolve hub CI failures

- og.ts: use SatoriNode type instead of unknown for satori() param
- Pin all GitHub Action refs to commit SHAs (validate-pins)
- Add vercel to knip ignoreBinaries (hub-preview-cron uses npx vercel)

Author: dante01yoon

.github/workflows/hub-ci.yaml

@@ -64,7 +64,7 @@ jobs:
           SKIP_AI_GENERATION: 'true'
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: hub-build
           path: apps/hub/dist
@@ -85,7 +85,7 @@ jobs:
         uses: ./.github/actions/setup-frontend
 
       - name: Download build artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: hub-build
           path: apps/hub/dist
@@ -172,7 +172,7 @@ jobs:
 
       - name: Upload SEO reports
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: hub-seo-reports
           path: |

.github/workflows/hub-cron-rebuild.yaml

@@ -37,7 +37,7 @@ jobs:
           token: ${{ secrets.GH_TOKEN }}
 
       - name: Restore content cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: apps/hub/.content-cache
           key: hub-content-cache-cron-prod-${{ hashFiles('_workflow_templates/templates/**', 'apps/hub/src/**') }}
@@ -59,7 +59,7 @@ jobs:
           PUBLIC_APPROVED_ONLY: 'true'
 
       - name: Deploy to Vercel
-        uses: amondnet/vercel-action@v25
+        uses: amondnet/vercel-action@16e87c0a08142b0d0d33b76aeaf20823c381b9b9 # v25.2.0
         with:
           vercel-token: ${{ secrets.VERCEL_TOKEN }}
           vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}

.github/workflows/hub-deploy.yaml

@@ -49,7 +49,7 @@ jobs:
           token: ${{ secrets.GH_TOKEN }}
 
       - name: Restore content cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: apps/hub/.content-cache
           key: hub-content-cache-${{ hashFiles('_workflow_templates/templates/**', 'apps/hub/src/**') }}
@@ -71,7 +71,7 @@ jobs:
           PUBLIC_APPROVED_ONLY: 'true'
 
       - name: Deploy to Vercel
-        uses: amondnet/vercel-action@v25
+        uses: amondnet/vercel-action@16e87c0a08142b0d0d33b76aeaf20823c381b9b9 # v25.2.0
         with:
           vercel-token: ${{ secrets.VERCEL_TOKEN }}
           vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}

.github/workflows/hub-preview-cron.yaml

@@ -73,7 +73,7 @@ jobs:
           token: ${{ secrets.GH_TOKEN }}
 
       - name: Restore content cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: apps/hub/.content-cache
           key: hub-content-cache-cron-${{ matrix.ref }}-${{ matrix.api_env }}-${{ hashFiles('_workflow_templates/templates/**', 'apps/hub/src/**') }}
@@ -95,7 +95,7 @@ jobs:
 
       - name: Deploy to Vercel
         id: deploy
-        uses: amondnet/vercel-action@v25
+        uses: amondnet/vercel-action@16e87c0a08142b0d0d33b76aeaf20823c381b9b9 # v25.2.0
         with:
           vercel-token: ${{ secrets.VERCEL_TOKEN }}
           vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
@@ -125,7 +125,7 @@ jobs:
 
       - name: Comment preview URL on PR
         if: matrix.pr > 0
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
         with:
           number: ${{ matrix.pr }}
           header: hub-preview-cron

.github/workflows/hub-preview.yaml

@@ -35,7 +35,7 @@ jobs:
           token: ${{ secrets.GH_TOKEN }}
 
       - name: Restore content cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: apps/hub/.content-cache
           key: hub-content-cache-preview-${{ hashFiles('_workflow_templates/templates/**', 'apps/hub/src/**') }}
@@ -57,7 +57,7 @@ jobs:
 
       - name: Deploy preview to Vercel
         id: deploy
-        uses: amondnet/vercel-action@v25
+        uses: amondnet/vercel-action@16e87c0a08142b0d0d33b76aeaf20823c381b9b9 # v25.2.0
         with:
           vercel-token: ${{ secrets.VERCEL_TOKEN }}
           vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
@@ -67,7 +67,7 @@ jobs:
 
       - name: Comment preview URL
         if: github.event_name == 'pull_request'
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
         with:
           header: hub-vercel-preview
           message: |

apps/hub/src/lib/og.ts

@@ -1,7 +1,7 @@
 import satori from 'satori'
 import { Resvg } from '@resvg/resvg-js'
 import sharp from 'sharp'
-import type { SatoriOptions } from 'satori'
+import type { SatoriOptions, SatoriNode } from 'satori'
 
 const WIDTH = 1200
 const HEIGHT = 630
@@ -267,7 +267,7 @@ function creatorLayout(
   }
 }
 
-export async function renderOgPng(layout: unknown): Promise<Uint8Array> {
+export async function renderOgPng(layout: SatoriNode): Promise<Uint8Array> {
   const fonts = await loadFonts()
   const svg = await satori(layout, {
     width: WIDTH,

knip.config.ts

@@ -60,7 +60,7 @@ const config: KnipConfig = {
       ]
     }
   },
-  ignoreBinaries: ['python3'],
+  ignoreBinaries: ['python3', 'vercel'],
   ignoreDependencies: [
     // Weird importmap things
     '@iconify-json/lucide',