pin actions to specific commit sha (#5026)

nginxinc · Feb 7, 2024 · 5cad374 · 5cad374
1 parent 0d8224b
commit 5cad374
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -325,15 +325,15 @@ jobs:
 
       - name: Authenticate to Google Cloud
         id: auth
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@5a50e581162a13f4baa8916d01180d2acbc04363 # v2.1.0
         with:
           token_format: access_token
           workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
           service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
         if: github.event.pull_request.head.repo.full_name == github.repository
 
       - name: Login to GCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
         with:
           registry: gcr.io
           username: oauth2accesstoken
@@ -349,7 +349,7 @@ jobs:
         if: github.event.pull_request.head.repo.full_name == github.repository
 
       - name: Build Test-Runner Container
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
         with:
           file: tests/Dockerfile
           context: "."