From 75452f36a3f74b95577b270eefdc2a44088b02c1 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <andrei.kvapil@aenix.io>
Date: Tue, 7 Jul 2026 11:28:53 +0200
Subject: [PATCH] ci(actions): pin third-party GitHub Actions to commit SHAs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pin the remaining floating version tags in the build-main and ui-test
workflows to immutable commit SHAs, preserving the original tag in a
trailing comment so Renovate can keep the pins up to date.

Supply-chain hardening against tag hijacking/mutation; no functional
change — each SHA is the commit the tag currently resolves to.

Assisted-By: Claude
Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>
---
 .github/workflows/build-main.yaml | 6 +++---
 .github/workflows/ui-test.yaml    | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/build-main.yaml b/.github/workflows/build-main.yaml
index eda19cce0..7da59a8da 100644
--- a/.github/workflows/build-main.yaml
+++ b/.github/workflows/build-main.yaml
@@ -46,7 +46,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -69,7 +69,7 @@ jobs:
           fi
 
       - name: Login to OCIR
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           username: ${{ secrets.OCIR_USER }}
           password: ${{ secrets.OCIR_TOKEN }}
@@ -82,7 +82,7 @@ jobs:
       # isolated buildkit so it never contends with PR builds on the shared one.
       - name: Set up Buildx (docker-container driver)
         id: buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
         with:
           driver: docker-container
         env:
diff --git a/.github/workflows/ui-test.yaml b/.github/workflows/ui-test.yaml
index e3f735d56..d0e175f90 100644
--- a/.github/workflows/ui-test.yaml
+++ b/.github/workflows/ui-test.yaml
@@ -24,17 +24,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           # The monorepo root has no package.json; read the pnpm version from
           # the console workspace manifest (packageManager field).
           package_json_file: packages/system/dashboard/images/console/package.json
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
           cache: pnpm