From 7ae89d269c01d9eb2ae70ae02b146c3a3301d5df Mon Sep 17 00:00:00 2001 From: Aaron Coburn Date: Tue, 4 Aug 2026 17:33:32 -0500 Subject: [PATCH] chore: pin GitHub Actions to SHA digests Pin all third-party and reusable GitHub Actions to full SHA commit digests instead of mutable version tags for improved supply chain security. Co-Authored-By: Claude Opus 4.6 --- .github/workflows/cd-config.yml | 2 +- .github/workflows/ci-config.yml | 8 ++++---- .github/workflows/site-ci-config.yml | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/cd-config.yml b/.github/workflows/cd-config.yml index 722427b6d75..b5d9397f6e6 100644 --- a/.github/workflows/cd-config.yml +++ b/.github/workflows/cd-config.yml @@ -31,7 +31,7 @@ jobs: envName: "Development" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up JDK 17 uses: actions/setup-java@v5.6.0 diff --git a/.github/workflows/ci-config.yml b/.github/workflows/ci-config.yml index 58045f1bbac..9314bbb3c8b 100644 --- a/.github/workflows/ci-config.yml +++ b/.github/workflows/ci-config.yml @@ -19,7 +19,7 @@ jobs: fail-fast: false steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up JDK ${{ matrix.java }} uses: actions/setup-java@v5.6.0 @@ -55,7 +55,7 @@ jobs: java: [ 17 ] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up JDK ${{ matrix.java }} uses: actions/setup-java@v5.6.0 @@ -78,7 +78,7 @@ jobs: java: [ 17 ] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up JDK ${{ matrix.java }} uses: actions/setup-java@v5.6.0 @@ -98,7 +98,7 @@ jobs: if: ${{ github.actor != 'dependabot[bot]' }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up JDK 17 uses: actions/setup-java@v5.6.0 diff --git a/.github/workflows/site-ci-config.yml b/.github/workflows/site-ci-config.yml index f41a46b82ec..c2dd9ee25ea 100644 --- a/.github/workflows/site-ci-config.yml +++ b/.github/workflows/site-ci-config.yml @@ -19,7 +19,7 @@ jobs: java: [ 17 ] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up JDK ${{ matrix.java }} uses: actions/setup-java@v5.6.0