BAU: use full SHAs for actions

whi-tw · whi-tw · commit 05fa30f13475 · 2025-10-21T15:59:11.000+01:00
diff --git a/.github/workflows/forms-cli.yml b/.github/workflows/forms-cli.yml
@@ -19,7 +19,7 @@ jobs:
         working-directory: support/forms-cli
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Determine Ruby version
         id: determine-ruby-version
         run: |
diff --git a/.github/workflows/guardrail_infracost_config.yml b/.github/workflows/guardrail_infracost_config.yml
@@ -18,7 +18,7 @@ jobs:
     name: Check infracost config is up to date
     steps:
       - name: Checkout code
-        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set up Ruby
         uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
diff --git a/.github/workflows/guardrail_matching_pentester_cidr_blocks.yml b/.github/workflows/guardrail_matching_pentester_cidr_blocks.yml
@@ -20,7 +20,7 @@ jobs:
     name: Check for matching CIDR blocks
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Install hcl2json
         run: |
diff --git a/.github/workflows/guardrail_tf_version_upgrade.yml b/.github/workflows/guardrail_tf_version_upgrade.yml
@@ -17,7 +17,7 @@ jobs:
     name: Leave a comment
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Leave a comment
         env:
diff --git a/.github/workflows/infracost.yml b/.github/workflows/infracost.yml
@@ -34,7 +34,7 @@ jobs:
 
       # Checkout the base branch of the pull request (e.g. main/master).
       - name: Checkout base branch
-        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: "${{ github.event.pull_request.base.ref }}"
 
@@ -47,7 +47,7 @@ jobs:
 
       # Checkout the current PR branch so we can create a diff.
       - name: Checkout PR branch
-        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/pipeline-visualiser.yml b/.github/workflows/pipeline-visualiser.yml
@@ -16,7 +16,7 @@ jobs:
         working-directory: support/pipeline-visualiser
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Run docker build
         run: docker build .
@@ -29,7 +29,7 @@ jobs:
         working-directory: support/pipeline-visualiser
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Determine Ruby version
         id: determine-ruby-version
         run: |
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
@@ -31,7 +31,7 @@ jobs:
       pull-requests: write
     steps:
       - name: 📦 Check Out Repository Code
-        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/require-pinned-github-actions.yml b/.github/workflows/require-pinned-github-actions.yml
@@ -16,6 +16,6 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Checkout code
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Ensure SHA pinned actions
         uses: zgosalvez/github-actions-ensure-sha-pinned-actions@9e9574ef04ea69da568d6249bd69539ccc704e74 # v4.0.0
diff --git a/.github/workflows/ruby-ci.yml b/.github/workflows/ruby-ci.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Install hcl2json
         run: |
diff --git a/.github/workflows/shell-ci.yml b/.github/workflows/shell-ci.yml
@@ -10,7 +10,7 @@ jobs:
     name: Shell
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Lint shell scripts
         run: |
diff --git a/.github/workflows/terraform-ci.yml b/.github/workflows/terraform-ci.yml
@@ -12,7 +12,7 @@ jobs:
     name: Run tests
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           # Grab the last 75 commits. Later on we need to a git diff, and it's
           # very likely that two commits involved will be inside the last 75
@@ -23,7 +23,7 @@ jobs:
         run: |
           echo "TERRAFORM_VERSION=$(cat .terraform-version)" >> "$GITHUB_OUTPUT"
 
-      - uses: hashicorp/setup-terraform@v3
+      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
         with:
           terraform_version: ${{steps.determine-terraform-version.outputs.TERRAFORM_VERSION}}
 
@@ -105,7 +105,7 @@ jobs:
             fi
           done;
 
-      - uses: actions/cache/restore@v4
+      - uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         id: restore-terraform-config-inspect
         with:
           key: terraform-config-inspect
@@ -115,7 +115,7 @@ jobs:
       ## It is purely needed to install a tool in this pipeline
       - name: "Install Go ${{env.GO_VERSION}}"
         if: steps.restore-terraform-config-inspect.outputs.cache-hit != 'true'
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
         with:
           go-version: "${{env.GO_VERSION}}"
 
diff --git a/.github/workflows/update-provider-locks.yml b/.github/workflows/update-provider-locks.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           # Use the pull request head ref to ensure we're on the PR branch
           ref: ${{ github.head_ref }}
@@ -26,7 +26,7 @@ jobs:
           token: ${{ github.actor == 'dependabot[bot]' && secrets.DEPENDABOT_PAT || secrets.GITHUB_TOKEN }}
 
       - name: Set up Go
-        uses: actions/setup-go@c0137caad775660c0844396c52da96e560aba63d # v6.0.0
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
 
       - name: Install tfupdate
         run: |
