From a081049b37b4879e3491686c4b733b38989c2133 Mon Sep 17 00:00:00 2001
From: Quentin Laplanche <quentin.laplanche@docker.com>
Date: Mon, 20 Apr 2026 10:59:04 +0200
Subject: [PATCH] chore: pin GitHub Actions to commit SHA -e Signed-off-by:
 Quentin Laplanche <quentin.laplanche@docker.com>

---
 .github/workflows/ci.yml                   | 6 +++---
 .github/workflows/release-weekly-build.yml | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 11fef42..ba22811 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,15 +20,15 @@ jobs:
       GO111MODULE: "on"
     steps:
       - name: Set up Go 1.16
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2
         with:
           go-version: 1.16
         id: go
 
       - name: Checkout code into the Go module directory
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
 
-      - uses: actions/cache@v2
+      - uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
         with:
           path: ~/go/pkg/mod
           key: go-${{ hashFiles('**/go.sum') }}
diff --git a/.github/workflows/release-weekly-build.yml b/.github/workflows/release-weekly-build.yml
index 8bb7274..ab5e462 100644
--- a/.github/workflows/release-weekly-build.yml
+++ b/.github/workflows/release-weekly-build.yml
@@ -16,13 +16,13 @@ jobs:
       GITHUB_WORKFLOW_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
     steps:
       - name: Set up Go 1.16
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2
         with:
           go-version: 1.16
         id: go
 
       - name: Checkout code into the Go module directory
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
         with:
           ref: ${{ github.event.inputs.branch }}
 
@@ -31,7 +31,7 @@ jobs:
 
       - name: Ship it
         if: ${{ github.event.inputs.tag != '' }} # don't release if no tag is specified
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1
         with:
           artifacts: "./bin/*"
           prerelease: true