From 4a120d814fd184f342249373a21c2b222955884a Mon Sep 17 00:00:00 2001 From: Max Rydahl Andersen Date: Tue, 19 May 2026 14:41:49 +0200 Subject: [PATCH] ci: pin GitHub Actions to full-length commit SHAs Pin all action references to full-length commit SHAs for supply chain security. This is required for the org-level policy: 'Require actions to be pinned to a full-length commit SHA'. Original version tags are preserved as comments for readability. --- .github/workflows/ci.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bd3586c..f727012 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,8 +16,8 @@ jobs: name: Build stubs + build all variants (smoke) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: jdx/mise-action@v3 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3 - name: Sanity check run: | @@ -38,7 +38,7 @@ jobs: tar -czf build.tgz build - name: Upload build artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: build-tgz path: build.tgz @@ -91,10 +91,10 @@ jobs: output: ./build/jpaxa-output/jpaxa-windows-x86_64.exe verify steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Download build - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: build-tgz path: .