From 289f40feeeb316899648b5aeb20b9aadb3783d32 Mon Sep 17 00:00:00 2001 From: Ihor Kalnytskyi Date: Sun, 2 Aug 2026 02:28:36 +0300 Subject: [PATCH] Pin and bump action versions used in CI Some Zizmor reports point out that actions used in CI are referenced by mutable version tags. Pin these actions to commit hashes to ensure the workflow always uses the expected code. At the same time, bump them to their latest versions to avoid deprecation warnings caused by outdated Node.js runtimes. --- .github/workflows/ci.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 906ec2a1..4d724be9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,7 +33,7 @@ jobs: - windows-2022 - windows-2025 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -42,7 +42,7 @@ jobs: id: postgres - name: Run setup-python - uses: actions/setup-python@v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" # PostgreSQL has no native ARM64 build for Windows, so the x64 @@ -86,7 +86,7 @@ jobs: - "16" - "17" steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -103,7 +103,7 @@ jobs: id: postgres - name: Run setup-python - uses: actions/setup-python@v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" # PostgreSQL has no native ARM64 build for Windows, so the x64 @@ -132,9 +132,9 @@ jobs: security-events: write steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Run zizmor - uses: zizmorcore/zizmor-action@e673c3917a1aef3c65c972347ed84ccd013ecda4 + uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2