From 98416964fee71a0b078a928ce6b30359c71508d4 Mon Sep 17 00:00:00 2001 From: Mansi Visuals Date: Sat, 1 Aug 2026 14:46:37 +0200 Subject: [PATCH] Pin docker actions to commit SHAs CodeQL's actions pack flagged four actions/unpinned-tag alerts: the two dev test workflows referenced docker/setup-buildx-action and docker/build-push-action by mutable major tag, so an upstream tag move would silently change what runs in CI. Pinned to the commits v4 and v7 currently resolve to, with the version kept in a trailing comment for readability. No behaviour change. Co-Authored-By: Claude Opus 5 --- .github/workflows/test-dev-clean-install.yml | 4 ++-- .github/workflows/test-dev-upgrade.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/test-dev-clean-install.yml b/.github/workflows/test-dev-clean-install.yml index 6356702c..95c95452 100644 --- a/.github/workflows/test-dev-clean-install.yml +++ b/.github/workflows/test-dev-clean-install.yml @@ -29,10 +29,10 @@ jobs: echo "redis_version=$REDIS_IMAGE" >> $GITHUB_OUTPUT - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Build image from source - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: . load: true diff --git a/.github/workflows/test-dev-upgrade.yml b/.github/workflows/test-dev-upgrade.yml index fad19c0a..59ae06fa 100644 --- a/.github/workflows/test-dev-upgrade.yml +++ b/.github/workflows/test-dev-upgrade.yml @@ -30,10 +30,10 @@ jobs: echo "from_version=$FROM_VERSION" >> $GITHUB_OUTPUT - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Build target image from source - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: . load: true