From b0ea3d186ff7fdda0a48c3bb0070460e585b6aeb Mon Sep 17 00:00:00 2001 From: nicodes Date: Sat, 1 Aug 2026 19:54:28 -0600 Subject: [PATCH] Pin the remaining third-party actions Caught by the standardization sweep: these were missed on the first pass. Third-party actions by SHA with the tag in a trailing comment. A tag is a moving reference, and whoever can move it can run code in these jobs. aviorstudio/* and nicodes/* stay on their version tags by decision. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7c99672..5790d09 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,7 +28,7 @@ jobs: release: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 0 @@ -80,7 +80,7 @@ jobs: - name: Set up Go if: inputs.target == 'cli' - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version-file: cli/go.mod cache-dependency-path: cli/go.sum