From 12b68614829950c9d7c552935321c312dd90ecd2 Mon Sep 17 00:00:00 2001 From: Andy Hunt Date: Wed, 20 Aug 2025 14:57:36 +0100 Subject: [PATCH] Globally pin GitHub Actions actions to commit hashes not tags We agree that pinning the versions of GitHub Actions actions to a commit hash instead of a mutable tag is the correct choice. We have a lot of places where we use them. The changes in this commit were generated by using a tool called pinact[1] which can convert pinned tags in GHA workflows to the commit hash they point to at that moment in time. To generate the change set I ran `pinact run` from the root of the repository. [1] https://github.com/suzuki-shunsuke/pinact --- .github/workflows/actionlint.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml index f21b009..948ce90 100644 --- a/.github/workflows/actionlint.yml +++ b/.github/workflows/actionlint.yml @@ -6,7 +6,7 @@ jobs: actionlint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 with: show-progress: false - uses: alphagov/govuk-infrastructure/.github/actions/actionlint@main