Andrei Kvapil 75452f36a3 ci(actions): pin third-party GitHub Actions to commit SHAs ...

Pin the remaining floating version tags in the build-main and ui-test
workflows to immutable commit SHAs, preserving the original tag in a
trailing comment so Renovate can keep the pins up to date.

Supply-chain hardening against tag hijacking/mutation; no functional
change — each SHA is the commit the tag currently resolves to.

Assisted-By: Claude
Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>

2026-07-07 11:28:53 +02:00

..

api-review-gate.yaml

fix(ci): build api-gate detector from base tip when merge base predates it

2026-07-03 18:39:21 +03:00

auto-release.yaml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

backport.yaml

fix(ci): nest backport conflict_resolution under experimental input

2026-06-30 18:03:19 +05:00

build-main.yaml

ci(actions): pin third-party GitHub Actions to commit SHAs

2026-07-07 11:28:53 +02:00

codegen-drift.yml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

codeql.yml

ci(codeql): build Go with manual mode instead of autobuild

2026-06-26 18:11:06 +05:00

labels.yaml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

pr-labeler.yaml

ci(pr-labeler): drop 'edited' trigger to stop bot PR re-run churn

2026-07-06 10:24:32 +05:00

pr-size.yaml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

pre-commit.yml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

pull-requests-release.yaml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

pull-requests.yaml

fix(ci): create the overlay output dir before flux pull

2026-06-30 18:33:17 +03:00

scorecard.yml

ci(scorecard): stop uploading SARIF to code-scanning; drop push trigger

2026-06-26 18:11:06 +05:00

stale.yaml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

tags.yaml

ci: harden workflow token permissions and pin actions by SHA

2026-06-23 11:32:16 +05:00

ui-test.yaml

ci(actions): pin third-party GitHub Actions to commit SHAs

2026-07-07 11:28:53 +02:00

update-releasenotes.yaml

ci(release): run update-releasenotes only on changelog changes

2026-06-26 18:11:05 +05:00