From 741f08b422b4d3b5b06f2cdec2645d742f3538a3 Mon Sep 17 00:00:00 2001 From: pos Date: Sat, 5 Sep 2026 17:12:50 +0200 Subject: [PATCH 1/3] M11.1: pin CI actions --- .github/workflows/ci.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9e95238..a500241 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,10 +12,10 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version: '1.24.x' @@ -31,10 +31,10 @@ jobs: run: go vet ./... - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Validate Compose env: From e8f3cb25b8ac0acdd2da447325abd6ddc17e6cc3 Mon Sep 17 00:00:00 2001 From: pos Date: Sat, 5 Sep 2026 17:13:07 +0200 Subject: [PATCH 2/3] M11.1: pin integration inputs --- .github/workflows/integration.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml index 56ddf08..63aead3 100644 --- a/.github/workflows/integration.yml +++ b/.github/workflows/integration.yml @@ -13,12 +13,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out soju-web - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Check out Ploos-AS soju packaging - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: repository: Ploos-AS/soju + ref: 5ba37fb3110375f5efc35ad59dc2e2a91eb33fe1 path: upstream-soju - name: Build soju From 590740be56008104e9a95e0a547efd6d4da93989 Mon Sep 17 00:00:00 2001 From: pos Date: Sat, 5 Sep 2026 17:13:23 +0200 Subject: [PATCH 3/3] M11.1: pin release actions --- .github/workflows/release.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e26004a..79205bc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,16 +18,16 @@ jobs: publish: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Log in to GHCR - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ghcr.io username: ${{ github.actor }} @@ -35,7 +35,7 @@ jobs: - name: Docker metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 with: images: ${{ env.IMAGE_NAME }} flavor: | @@ -47,7 +47,7 @@ jobs: - name: Build and push id: push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . platforms: linux/amd64,linux/arm64 @@ -61,7 +61,7 @@ jobs: sbom: true - name: Attest image - uses: actions/attest-build-provenance@v3 + uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3 with: subject-name: ${{ env.IMAGE_NAME }} subject-digest: ${{ steps.push.outputs.digest }}