From e09982fe21ccbca9c143a83b18dd01d26c16f597 Mon Sep 17 00:00:00 2001 From: Tom J Nowell Date: Sun, 20 Sep 2026 18:03:00 +0100 Subject: [PATCH] Pin GitHub Actions to commit SHAs A major tag like v5 can be moved to point at new code, and the release job runs with contents: write. A SHA cannot move. Each pin is the commit the major tag pointed at today, so behaviour does not change. --- .github/workflows/ci.yml | 6 +++--- .github/workflows/release.yml | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 46871d7..c0b1569 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,10 +14,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Setup Node - uses: actions/setup-node@v5 + uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 with: node-version: '22' cache: 'npm' @@ -35,7 +35,7 @@ jobs: run: npm run build - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: '8.2' coverage: none diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 059a873..eaa01c2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -13,7 +13,7 @@ jobs: contents: write steps: - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 # The tag is what everyone installs, so it has to agree with the two # places the version is written. `VERSION` is also the cache buster the @@ -27,7 +27,7 @@ jobs: || { echo "VERSION constant does not say ${VERSION}"; exit 1; } - name: Setup Node - uses: actions/setup-node@v5 + uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 with: node-version: '22' cache: 'npm'