From 15cf031c19321e25ebe08bc9549ccf2ab99abfa3 Mon Sep 17 00:00:00 2001
From: Eric Grill <eric@chain-bytes.com>
Date: Wed, 14 Jan 2026 07:57:57 +0000
Subject: [PATCH] ci: pin GitHub Actions to commit SHA for security

Pin all GitHub Actions to specific commit SHAs instead of mutable tags
to prevent supply chain attacks through:
- Malicious commits to existing tags
- Tag hijacking/deletion
- Upstream repository compromise

Actions pinned:
- actions/checkout: v2.7.0 -> ee0669bd1cc54295c223e0bb666b733df41de1c5
- actions/cache: v4.3.0 -> 0057852bfaa89a56745cba8c7296529d2fc39830
- actions/setup-java: v1.4.4 -> b6e674f4b717d7b0ae3baee0fbe79f498905dfde
- actions/upload-artifact: v4.6.2 -> ea165f8d65b6e75b540449e92b4886f43607fa02

Version comments added above each action for maintainability.
Dependabot can automatically update these SHAs when new versions are released.

Fixes #716

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 .github/workflows/testnet-build.yml | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/testnet-build.yml b/.github/workflows/testnet-build.yml
index ec557c0e1..ca5e1d319 100644
--- a/.github/workflows/testnet-build.yml
+++ b/.github/workflows/testnet-build.yml
@@ -17,12 +17,14 @@ jobs:
     # 1 - checkout project and dependencies
 
     - name: Checkout Phoenix
-      uses: actions/checkout@v2
+      # v2.7.0
+      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5
       with:
         path: phoenix
 
     - name: Checkout lightning-kmp
-      uses: actions/checkout@v2
+      # v2.7.0
+      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5
       with:
         repository: ACINQ/lightning-kmp
         ref: master
@@ -31,14 +33,16 @@ jobs:
     # 2 - setup cache/jdk
 
     - name: Cached Konan
-      uses: actions/cache@v4
+      # v4.3.0
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
       with:
         path: ~/.konan
         key: ${{ runner.os }}-konan-${{ hashFiles('**/*.gradle*') }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
         restore-keys: ${{ runner.os }}-konan-
 
     - name: Set up jdk 1.17
-      uses: actions/setup-java@v1
+      # v1.4.4
+      uses: actions/setup-java@b6e674f4b717d7b0ae3baee0fbe79f498905dfde
       with:
         java-version: 17
 
@@ -78,7 +82,8 @@ jobs:
       # 5 - upload apk
 
     - name: Upload apk as artifact for this action
-      uses: actions/upload-artifact@v4
+      # v4.6.2
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
       with:
         name: phoenix-testnet
         path: upload/phoenix-testnet-latest.apk