Pin GitHub Actions to commit SHAs

[jesserockz]

GitHub Actions in this repository reference actions or reusable workflows by mutable tag or branch instead of an immutable commit SHA.

Pinning to a full 40-character commit SHA prevents supply-chain attacks where a compromised or force-pushed tag silently changes the code your workflows execute.

Unpinned references

• actions/checkout@v4.2.2
• docker/build-push-action@v6.15.0
• docker/login-action@v3.4.0
• docker/setup-buildx-action@v3.10.0
• docker/setup-qemu-action@v3.6.0

What to do

Replace each tag/branch reference with its commit SHA and add a version comment:

# Before
uses: actions/checkout@v4

# After
uses: actions/checkout@11bd719...  # v4.2.2

References

• GitHub Blog: Four tips to keep your GitHub Actions workflows secure
• GitHub Docs: Security hardening for GitHub Actions