From 4682622b1275344764bfc66073b547d6fefc3a78 Mon Sep 17 00:00:00 2001 From: Jose Tomas Robles Hahn Date: Mon, 14 Sep 2026 12:14:32 -0300 Subject: [PATCH] chore(deps): Pin third-party GitHub Actions to commit hashes - A Git tag is mutable, so an action referenced by one can be replaced with different code without the reference changing, which `super-linter/super-linter` was already pinned against. - The version each hash corresponds to is kept in a trailing comment, which is the format Dependabot reads and rewrites when it bumps the action. - The reusable workflows of `cordada/github-actions-utils` are left referenced by branch, because they are internal to the organization. Co-Authored-By: Claude Opus 5 --- .github/workflows/git-commit-lint.yaml | 6 +++--- .github/workflows/super-linter.yaml | 2 +- .github/workflows/task-release-and-deploy-to-prod.yaml | 2 +- .github/workflows/task-release-and-publish.yaml | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/git-commit-lint.yaml b/.github/workflows/git-commit-lint.yaml index ab97685..1f3dc72 100644 --- a/.github/workflows/git-commit-lint.yaml +++ b/.github/workflows/git-commit-lint.yaml @@ -39,18 +39,18 @@ jobs: steps: - name: Check Out VCS Repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Set Up Node.js id: set_up_nodejs - uses: actions/setup-node@v7.0.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "lts/*" - name: Restoring/Saving Cache - uses: actions/cache@v6.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: node_modules key: js-v2-deps-${{ runner.os }}-${{ steps.set_up_nodejs.outputs.node-version }}-${{ env.COMMITLINT_CLI_VERSION }}-${{ env.COMMITLINT_CONFIG_CORDADA_VERSION }} diff --git a/.github/workflows/super-linter.yaml b/.github/workflows/super-linter.yaml index 6a836da..d05ca05 100644 --- a/.github/workflows/super-linter.yaml +++ b/.github/workflows/super-linter.yaml @@ -107,7 +107,7 @@ jobs: steps: - name: Check Out VCS Repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # Full git history is needed to get a proper list of changed files within `super-linter`. fetch-depth: 0 diff --git a/.github/workflows/task-release-and-deploy-to-prod.yaml b/.github/workflows/task-release-and-deploy-to-prod.yaml index 2fe6bd7..42912c1 100644 --- a/.github/workflows/task-release-and-deploy-to-prod.yaml +++ b/.github/workflows/task-release-and-deploy-to-prod.yaml @@ -66,7 +66,7 @@ jobs: steps: - name: Check Out VCS Repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ env.RELEASE_VCS_REF }} fetch-depth: 0 # Full Git history is needed to get a proper list of changes. diff --git a/.github/workflows/task-release-and-publish.yaml b/.github/workflows/task-release-and-publish.yaml index 3707277..39e45f4 100644 --- a/.github/workflows/task-release-and-publish.yaml +++ b/.github/workflows/task-release-and-publish.yaml @@ -49,7 +49,7 @@ jobs: steps: - name: Check Out VCS Repository - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ env.CREATE_RELEASE_VCS_REVISION_ID }}