From 9f4eb308be8fb6cb57b83a204667c5a15c4ab05b Mon Sep 17 00:00:00 2001 From: nodeselector Date: Wed, 8 Jul 2026 08:58:27 -0500 Subject: [PATCH] Pin workflow actions to full commit SHAs Prep for the public open-source release (github/open-source-releases#710). Replace moving major-version tags with full 40-character commit SHAs in ci.yml and release.yml, keeping a version comment for readability: - actions/checkout@v4 -> @34e11487... # v4.3.1 - actions/setup-go@v5 -> @40f1582b... # v5.6.0 This project defines and parses the Actions dependency lockfile; pinning its own workflow actions by SHA dogfoods the practice the lockfile exists to enforce. --- .github/workflows/ci.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 354e2d1..e1fe4af 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,9 +17,9 @@ jobs: matrix: go-version: ['1.19', '1.22', '1.23'] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version: ${{ matrix.go-version }} cache-dependency-path: go/go.sum diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 80d7d1e..ddc1b34 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,12 +31,12 @@ jobs: echo "::error::Releases must be cut from main (got $GITHUB_REF)." exit 1 - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 0 fetch-tags: true - - uses: actions/setup-go@v5 + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version: '1.19' cache-dependency-path: go/go.sum