Kevin Veen-Birkenbach 2c7f0a23d1 ci(actions): pin the third-party actions to commit SHAs ...

CodeQL flagged docker/setup-buildx-action, docker/login-action,
docker/build-push-action and cypress-io/github-action as unpinned: a
moving v3 or v6 tag lets whoever controls it change what runs with the
workflow's GHCR write token.

Each action is now pinned to the commit its tag points to today, with
the exact release as a trailing comment (v3.12.0, v3.7.0, v6.19.2,
v6.10.9), resolved through the GitHub API, so the code that runs does
not change. GitHub's own actions/* were not flagged and keep their tags.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-10 17:35:07 +02:00

2.3 KiB

Raw Blame History

View Raw