chore: pin GitHub Actions to commit SHAs

[slawomirbabicz]

Pin GitHub Actions to commit SHAs

GitHub Actions referenced by tag (e.g. actions/checkout@v4) use a mutable pointer — the tag owner can move it to a different commit at any time, including a malicious one. This is the attack vector used in the tj-actions/changed-files incident (CVE-2025-30066).

Pinning to a full 40-character commit SHA makes the reference immutable. The # tag comment preserves human readability so reviewers can tell which version is pinned.

Important: a SHA can also originate from a forked repository. A malicious actor can fork an action, push a compromised commit to the fork, and the SHA will resolve — but it won't exist in the upstream canonical repo. Each SHA in this PR was verified against the action's canonical repository (not a fork).

Changes

• actions/checkout@v4 -> actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

  • Version: v4.3.1 | Latest: v6.0.2 | Release age: 89d
  • Commit: actions/checkout@34e1148

• docker/login-action@v3 -> docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0

  • Version: v3.7.0 | Latest: v4.1.0 | Release age: 36d
  • Commit: docker/login-action@c94ce9f
  • Warnings: Latest release v4.1.0 is only 6 day(s) old (< 7 days). Using previous safe release.

• docker/metadata-action@v5 -> docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0

  • Version: v5.10.0 | Latest: v6.0.0 | Release age: 34d
  • Commit: docker/metadata-action@c299e40

• docker/build-push-action@v5 -> docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0

  • Version: v5.4.0 | Latest: v7.0.0 | Release age: 34d
  • Commit: docker/build-push-action@ca052bb

• docker/setup-qemu-action@v3 -> docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

  • Version: v3.7.0 | Latest: v4.0.0 | Release age: 36d
  • Commit: docker/setup-qemu-action@c7c5346

• docker/setup-buildx-action@v3 -> docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

  • Version: v3.12.0 | Latest: v4.0.0 | Release age: 35d
  • Commit: docker/setup-buildx-action@8d2750c

• docker/build-push-action@v6 -> docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2

  • Version: v6.19.2 | Latest: v7.0.0 | Release age: 34d
  • Commit: docker/build-push-action@10e90e3

Files modified

• .github/workflows/ci.yml

Security warnings

• Latest release v4.1.0 is only 6 day(s) old (< 7 days). Using previous safe release.