From c097d5b7d0e0ec7ce449dd446f55affa24a0d88c Mon Sep 17 00:00:00 2001 From: Darcy Wong Date: Wed, 18 Mar 2026 07:32:48 +0700 Subject: [PATCH] fix(common): pin sha versions --- .../actions/build-binary-packages/action.yml | 4 ++-- .github/workflows/api-verification.yml | 6 +++--- .../workflows/build-test-publish-docker.yml | 4 ++-- .github/workflows/core-arm64-windows-test.yml | 4 ++-- .github/workflows/crowdin.yml | 2 +- .github/workflows/deb-packaging.yml | 18 +++++++++--------- .github/workflows/labeler.yml | 2 +- .github/workflows/npm-publish.yml | 2 +- .github/workflows/pr-build-status.yml | 2 +- 9 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/actions/build-binary-packages/action.yml b/.github/actions/build-binary-packages/action.yml index 23c01c545a..1483f58e5c 100644 --- a/.github/actions/build-binary-packages/action.yml +++ b/.github/actions/build-binary-packages/action.yml @@ -25,7 +25,7 @@ runs: using: 'composite' steps: - name: Download Artifacts - uses: actions/download-artifact@v8.0.1 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: keyman-srcpkg path: artifacts/keyman-srcpkg @@ -49,7 +49,7 @@ runs: echo '```' >> $GITHUB_STEP_SUMMARY - name: Store binary packages - uses: actions/upload-artifact@v7.0.0 + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: keyman-binarypkgs-${{ inputs.dist }}_${{ inputs.arch }} path: | diff --git a/.github/workflows/api-verification.yml b/.github/workflows/api-verification.yml index 79e4f8ea52..56726817dc 100644 --- a/.github/workflows/api-verification.yml +++ b/.github/workflows/api-verification.yml @@ -27,7 +27,7 @@ jobs: steps: - name: Restore artifacts - uses: actions/cache/restore@v5.0.3 + uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 with: path: | artifacts @@ -55,7 +55,7 @@ jobs: - name: Checkout if: steps.environment_step.outputs.SKIP_API_CHECK != 'true' - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: '${{ steps.environment_step.outputs.GIT_SHA }}' fetch-depth: 0 @@ -84,7 +84,7 @@ jobs: - name: Archive .symbols file if: steps.environment_step.outputs.SKIP_API_CHECK != 'true' && always() - uses: actions/upload-artifact@v7.0.0 + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: libkeymancore.symbols path: ${{ github.workspace }}/keyman/linux/debian/tmp/DEBIAN/symbols diff --git a/.github/workflows/build-test-publish-docker.yml b/.github/workflows/build-test-publish-docker.yml index 7ff6bb0495..edb9ebb98f 100644 --- a/.github/workflows/build-test-publish-docker.yml +++ b/.github/workflows/build-test-publish-docker.yml @@ -41,7 +41,7 @@ jobs: steps: - name: Checkout repository id: checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Build Docker images id: build run: | @@ -67,7 +67,7 @@ jobs: steps: - name: Checkout repository id: checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Test Docker images id: test diff --git a/.github/workflows/core-arm64-windows-test.yml b/.github/workflows/core-arm64-windows-test.yml index a818957a7a..0eb4e8f8f6 100644 --- a/.github/workflows/core-arm64-windows-test.yml +++ b/.github/workflows/core-arm64-windows-test.yml @@ -40,7 +40,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: '${{ github.event.client_payload.buildSha }}' @@ -64,7 +64,7 @@ jobs: npm -v node -v - - uses: actions/setup-python@v6.2.0 + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.13' diff --git a/.github/workflows/crowdin.yml b/.github/workflows/crowdin.yml index 7294d3e505..d0c14de948 100644 --- a/.github/workflows/crowdin.yml +++ b/.github/workflows/crowdin.yml @@ -13,7 +13,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: crowdin action uses: crowdin/github-action@v2.7.0 diff --git a/.github/workflows/deb-packaging.yml b/.github/workflows/deb-packaging.yml index 169ff651c1..6e7fe54cb3 100644 --- a/.github/workflows/deb-packaging.yml +++ b/.github/workflows/deb-packaging.yml @@ -43,7 +43,7 @@ jobs: PRERELEASE_TAG: ${{ steps.prerelease_tag.outputs.PRERELEASE_TAG }} steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: '${{ github.event.client_payload.buildSha }}' @@ -121,7 +121,7 @@ jobs: echo "- $(find . -name keyman_\*.dsc)" >> $GITHUB_STEP_SUMMARY - name: Store source package - uses: actions/upload-artifact@v7.0.0 + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 with: name: keyman-srcpkg path: | @@ -140,7 +140,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: '${{ github.event.client_payload.buildSha }}' sparse-checkout: '.github/actions/' @@ -166,7 +166,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: '${{ github.event.client_payload.buildSha }}' sparse-checkout: '.github/actions/' @@ -204,13 +204,13 @@ jobs: sudo rm -rf /usr/share/dotnet - name: Download Source Artifacts - uses: actions/download-artifact@v8.0.1 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: keyman-srcpkg path: artifacts - name: Download Binary Artifacts - uses: actions/download-artifact@v8.0.1 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: path: artifacts pattern: keyman-binarypkgs-* @@ -281,7 +281,7 @@ jobs: echo "::endgroup::" - name: Download Artifacts - uses: actions/download-artifact@v8.0.1 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: keyman-signedpkgs @@ -343,7 +343,7 @@ jobs: steps: - name: Download Artifacts - uses: actions/download-artifact@v8.0.1 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: path: artifacts pattern: keyman-* @@ -362,7 +362,7 @@ jobs: echo "SKIP_API_CHECK=${{ github.event.client_payload.skipApiCheck }}" >> artifacts/env - name: Cache artifacts - uses: actions/cache/save@v5.0.3 + uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 with: path: | artifacts diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 9a60fc9ee9..ee7fe7d03d 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -8,7 +8,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Update labels based on changed files - uses: actions/labeler@v6.0.1 + uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1 with: repo-token: "${{ secrets.GITHUB_TOKEN }}" - name: Update labels based on PR title diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 8b49e0b7cd..551045c056 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -50,7 +50,7 @@ jobs: fi - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: '${{ github.event.client_payload.buildSha }}' diff --git a/.github/workflows/pr-build-status.yml b/.github/workflows/pr-build-status.yml index 487a58ae5f..bd5fe2f46a 100644 --- a/.github/workflows/pr-build-status.yml +++ b/.github/workflows/pr-build-status.yml @@ -33,7 +33,7 @@ jobs: steps: - name: Check PR build status id: run_pr_build_status_script - uses: actions/github-script@v8.0.0 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: script: | // This code is copied out of resources/build/pr-build-status/pr-build-status.mjs