From 27a603125b9917416ea6572023c05d2a368e83cc Mon Sep 17 00:00:00 2001 From: Riccardo Sarro Date: Mon, 22 Jun 2026 12:04:38 +0200 Subject: [PATCH] fix: pin GitHub Actions to SHA for supply chain security Co-authored-by: Cursor Agent --- .github/workflows/go.yml | 4 ++-- .github/workflows/staticcheck.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index 15c11c3..98c557d 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -12,13 +12,13 @@ jobs: steps: - name: Set up Go ${{matrix.goversion}} on ${{matrix.os}} - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version: ${{matrix.goversion}} id: go - name: Check out code into the Go module directory - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: gofmt run: | diff --git a/.github/workflows/staticcheck.yml b/.github/workflows/staticcheck.yml index 03adb39..e28950f 100644 --- a/.github/workflows/staticcheck.yml +++ b/.github/workflows/staticcheck.yml @@ -6,9 +6,9 @@ jobs: name: "staticcheck" runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: fetch-depth: 1 - - uses: dominikh/staticcheck-action@v1.3.1 + - uses: dominikh/staticcheck-action@9716614d4101e79b4340dd97b10e54d68234e431 # v1.4.1 with: version: "2024.1.1"