From e39adfd029d505fe0fd34c6f22807d825689df71 Mon Sep 17 00:00:00 2001 From: Riyad Khan <65298773+rr3khan@users.noreply.github.com> Date: Fri, 3 Jul 2026 18:32:49 -0400 Subject: [PATCH 1/3] chore: pin check flake 3rd party actions --- .github/workflows/check-flake.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/check-flake.yml b/.github/workflows/check-flake.yml index 05297777..3905d204 100644 --- a/.github/workflows/check-flake.yml +++ b/.github/workflows/check-flake.yml @@ -12,12 +12,12 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 - - uses: DeterminateSystems/nix-installer-action@v22 - - uses: DeterminateSystems/magic-nix-cache-action@v13 + - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 + - uses: DeterminateSystems/magic-nix-cache-action@565684385bcd71bad329742eefe8d12f2e765b39 # v13 with: use-flakehub: false - name: Check Nix flake inputs - uses: DeterminateSystems/flake-checker-action@v5 + uses: DeterminateSystems/flake-checker-action@4b90f9fc724969ff153fe1803460917c84fe00a3 # v5 with: fail-mode: true send-statistics: false From a199e5e9d40b45125608ce99374502d2c9fd29cc Mon Sep 17 00:00:00 2001 From: Riyad Khan <65298773+rr3khan@users.noreply.github.com> Date: Fri, 3 Jul 2026 18:40:26 -0400 Subject: [PATCH 2/3] chore: pin golangci actions --- .github/workflows/test.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 18b6e959..03edd1c6 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -41,7 +41,7 @@ jobs: go-version: 1.19 - name: Lint with golangci-lint - uses: golangci/golangci-lint-action@v9 + uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9 with: # version of golangci-lint to use # Version should stay in sync with version used for local linting (lint job in Makefile). From 906d5f267ff42a61e4e175b4f28e50fd5d8511b3 Mon Sep 17 00:00:00 2001 From: Riyad Khan <65298773+rr3khan@users.noreply.github.com> Date: Fri, 3 Jul 2026 18:42:25 -0400 Subject: [PATCH 3/3] chore: pin update dependencies actions --- .github/workflows/update-flake-dependencies.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/update-flake-dependencies.yml b/.github/workflows/update-flake-dependencies.yml index e70fe1a7..ff5e0923 100644 --- a/.github/workflows/update-flake-dependencies.yml +++ b/.github/workflows/update-flake-dependencies.yml @@ -9,8 +9,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 - - uses: DeterminateSystems/nix-installer-action@v22 - - uses: DeterminateSystems/magic-nix-cache-action@v13 + - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 + - uses: DeterminateSystems/magic-nix-cache-action@565684385bcd71bad329742eefe8d12f2e765b39 # v13 with: use-flakehub: false - name: Update flake.lock and create signed commit with flake.lock changes