From c124b4a8aba6a46da179d36ea002455da8673222 Mon Sep 17 00:00:00 2001 From: Yordis Prieto Date: Wed, 2 Sep 2026 14:58:55 -0400 Subject: [PATCH] chore(ci): pin actions to immutable commit SHAs Mutable tags let an upstream maintainer change what runs in CI after review. Signed-off-by: Yordis Prieto --- .github/workflows/ci.yml | 6 +++--- .github/workflows/release-please.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5c6ff4f..cd37abf 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,11 +20,11 @@ jobs: go-version: [1.24.x] steps: - - uses: actions/checkout@v5.0.0 - - uses: actions/setup-go@v6.1.0 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0 with: go-version: ${{ matrix.go-version }} - - uses: golangci/golangci-lint-action@v9.1.0 + - uses: golangci/golangci-lint-action@e7fa5ac41e1cf5b7d48e45e42232ce7ada589601 # v9.1.0 with: version: latest - run: go test -race -v ./... diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 88f9251..f99fdd7 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Release Please id: release - uses: googleapis/release-please-action@v4.4.0 + uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0 with: token: ${{ secrets.GH_PAT_RELEASE_PLEASE_ACTION }} config-file: .github/.release-please-config.json