From 00946731c32035ec768ed27813dd2d8671c05e6e Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Thu, 28 May 2026 12:47:56 +0900 Subject: [PATCH] ci: pin third-party GitHub Actions to commit SHAs Signed-off-by: Arpit Jain --- .github/workflows/release.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a7f96d96..dc385111 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -32,9 +32,9 @@ jobs: with: submodules: true - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 - name: Setup buildx instance - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Build shell: bash run: | @@ -113,7 +113,7 @@ jobs: shell: bash run: ls -l releases*/ - name: Create Release - uses: "marvinpinto/action-automatic-releases@latest" + uses: "marvinpinto/action-automatic-releases@d68defdd11f9dcc7f52f35c1b7c236ee7513bcc1" # latest with: repo_token: "${{ secrets.GITHUB_TOKEN }}" automatic_release_tag: "latest" @@ -134,7 +134,7 @@ jobs: shell: bash run: ls -l releases*/ - name: Create Release - uses: "marvinpinto/action-automatic-releases@latest" + uses: "marvinpinto/action-automatic-releases@d68defdd11f9dcc7f52f35c1b7c236ee7513bcc1" # latest with: repo_token: "${{ secrets.GITHUB_TOKEN }}" prerelease: false