From 26268c6d77d1c1059cd4a0fb88ae170c64cd2d9a Mon Sep 17 00:00:00 2001 From: Yibo Zhuang Date: Wed, 23 Sep 2026 09:51:48 -0700 Subject: [PATCH] Pin release workflow actions to full commit SHAs (#70) --- .github/workflows/release.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 22690d6..bbe7f99 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,11 +17,11 @@ jobs: timeout-minutes: 60 environment: publish steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version-file: go.mod cache: true @@ -43,7 +43,7 @@ jobs: permission-contents: write permission-pull-requests: write - name: Release - uses: goreleaser/goreleaser-action@v7 + uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7 with: distribution: goreleaser-pro version: "~> v2" @@ -61,16 +61,16 @@ jobs: runs-on: macos-26 timeout-minutes: 60 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version-file: go.mod cache: true - name: Release dry run - uses: goreleaser/goreleaser-action@v7 + uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7 with: distribution: goreleaser-pro version: "~> v2" @@ -78,7 +78,7 @@ jobs: env: GITHUB_TOKEN: ${{ github.token }} - name: Upload dry-run artifacts - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: tart-guest-agent-snapshot path: dist/**