From baa2229abf0dcb87e0f0a0282917a01bbf5507f6 Mon Sep 17 00:00:00 2001 From: PJ Date: Sun, 16 Aug 2026 01:22:58 +0530 Subject: [PATCH] ci: pin third-party actions to commit shas buf-setup-action was already pinned with a comment saying why; the other five rode mutable major tags, so a tag move is an unreviewed change to what runs. Each major currently resolves to the release named in the comment, so this freezes today's behaviour rather than changing it. actions/* stay on major tags: they are first-party to the runner. --- .github/workflows/ci.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5996fc2..ce6fe69 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -34,7 +34,7 @@ jobs: java-version: "17" - name: Set up Android SDK - uses: android-actions/setup-android@v4 + uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1 - name: Set up Node 22 uses: actions/setup-node@v7 @@ -44,7 +44,7 @@ jobs: cache-dependency-path: pkg/spec/package-lock.json - name: Set up bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version: "1.3.13" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5e35c1d..0dc1982 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -120,7 +120,7 @@ jobs: java-version: "17" - name: Set up Android SDK - uses: android-actions/setup-android@v4 + uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1 - name: Cache Gradle uses: actions/cache@v6 @@ -136,7 +136,7 @@ jobs: run: make sidecar - name: Run GoReleaser - uses: goreleaser/goreleaser-action@v7 + uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 with: version: "~> v2" args: release --clean