Pin actions to a full length commit SHA

https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
wagdav · May 19, 2024 · a56af77 · a56af77
1 parent 09ebd6a
commit a56af77
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 6 deletions.
diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml
@@ -1,3 +1,4 @@
+# yamllint disable rule:line-length
 ---
 name: "Build and deploy site"
 on:  # yamllint disable-line rule:truthy
@@ -7,11 +8,11 @@ jobs:
   tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29  # v4.1.6
         with:
           fetch-depth: 0
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - uses: DeterminateSystems/nix-installer-action@8cdf194da984e4f12b2f8c36d1fa107c1dd67f5c  # v11
+      - uses: DeterminateSystems/magic-nix-cache-action@87e8236f46702ab0ce5a058b605a173ec88d618e  # v6
       - run: nix-build -A checks.x86_64-linux
       - run: |
           scripts/publish.sh

diff --git a/.github/workflows/update-flake-lock.yml b/.github/workflows/update-flake-lock.yml
@@ -1,3 +1,4 @@
+# yamllint disable rule:line-length
 ---
 name: update-flake-lock
 on:  # yamllint disable-line rule:truthy
@@ -9,6 +10,6 @@ jobs:
   lockfile:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/update-flake-lock@v21
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29  # v4.1.6
+      - uses: DeterminateSystems/nix-installer-action@8cdf194da984e4f12b2f8c36d1fa107c1dd67f5c  # v11
+      - uses: DeterminateSystems/update-flake-lock@a3ccb8f59719c48d6423e97744560221bcf7a3fa  # v21