From 447d480e7646fd9415d1453fe63fd8aa50ae903c Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Sun, 1 Nov 2026 18:15:14 +0100 Subject: [PATCH] ci: pin all GitHub Actions to commit SHAs instead of tags Org rule: actions are referenced by SHA with the version as a comment (uses: owner/action@ # vN), so a moved tag can never silently change what CI runs. Rewrites every tag-pinned uses: in .github/workflows. --- .github/workflows/checks.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml index bf8627d..ef8bfd0 100644 --- a/.github/workflows/checks.yml +++ b/.github/workflows/checks.yml @@ -11,7 +11,7 @@ jobs: name: ci runs-on: [self-hosted, linux, x64, light] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Validate files exist run: | test -f profile/README.md @@ -21,7 +21,7 @@ jobs: name: lint runs-on: [self-hosted, linux, x64, light] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Validate markdown run: | # Check for broken relative image references @@ -39,7 +39,7 @@ jobs: name: test runs-on: [self-hosted, linux, x64, light] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Validate SVG run: | # Check SVG is well-formed XML