From c0f5eacbebe6753c7b453476b1a6a18542752859 Mon Sep 17 00:00:00 2001 From: "Alvaro J. Genial" Date: Thu, 23 Jul 2026 16:48:47 +0100 Subject: [PATCH] Pin CI actions to commit SHAs; harden checkout --- .github/workflows/ci.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d0c4d1c..b104ef3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,12 +16,14 @@ jobs: matrix: go-pkg: ['go_1_17', 'go_1_18', 'go_1_19', 'go_1_20', 'go_1_21', 'go_1_22', 'go_1_23', 'go_1_24', 'go_1_25', 'go_1_26'] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - uses: nixbuild/nix-quick-install-action@v35 + - uses: nixbuild/nix-quick-install-action@9f63be77f412a248c9d9a65a4c82cf066cdf8f0c # v35 - name: Restore and cache Nix store - uses: nix-community/cache-nix-action@v7.0.2 + uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2 with: primary-key: nix-${{ runner.os }}-${{ matrix.go-pkg }}-${{ hashFiles('shell.nix') }}