Pin action versions using hash

marcransome · Mar 15, 2024 · e46e4c4 · e46e4c4
1 parent d85e4f9
commit e46e4c4
Show file tree

Hide file tree

Showing 3 changed files with 31 additions and 27 deletions.
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
@@ -10,9 +10,9 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
-      - name: Dependency review
-        uses: actions/dependency-review-action@v4
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - name: Dependency Review
+        uses: actions/dependency-review-action@9129d7d40b8c12c1ed0f60400d00c92d437adcce # v4.1.3
         with:
           comment-summary-in-pr: true
           fail-on-severity: low

diff --git a/.github/workflows/markdown-links.yml b/.github/workflows/markdown-links.yml
@@ -16,18 +16,19 @@ jobs:
   markdown-links:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - name: Check links in modified Markdown files
-      if: github.event_name == 'pull_request'
-      uses: gaurav-nelson/github-action-markdown-link-check@v1
-      with:
-        base-branch: main
-        check-modified-files-only: yes
-        use-verbose-mode: yes
-        config-file: .github/markdown-links.json
-    - name: Check links in all Markdown files
-      if: github.event_name != 'pull_request'
-      uses: gaurav-nelson/github-action-markdown-link-check@v1
-      with:
-        use-verbose-mode: yes
-        config-file: .github/markdown-links.json
+      - name: Checkout repository
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - name: Check links in modified Markdown files
+        if: github.event_name == 'pull_request'
+        uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec # 1.0.15
+        with:
+          base-branch: main
+          check-modified-files-only: yes
+          use-verbose-mode: yes
+          config-file: .github/markdown-links.json
+      - name: Check links in all Markdown files
+        if: github.event_name != 'pull_request'
+        uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec # 1.0.15
+        with:
+          use-verbose-mode: yes
+          config-file: .github/markdown-links.json
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -14,9 +14,10 @@ jobs:
   syntax:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       - name: Install fish shell
-        uses: fish-actions/install-fish@v1
+        uses: fish-actions/install-fish@d6d9d26231a15f8d9a6b3e74b3db45512440e3e8 # v1.1.0
       - name: Syntax check fish files
         uses: fish-shop/syntax-check@v1
   tests:
@@ -25,18 +26,19 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       - name: Fetch repository history for access to tags in tests
         run: git fetch --prune --unshallow --tags --force
       - name: Install fish shell
-        uses: fish-actions/install-fish@v1
+        uses: fish-actions/install-fish@d6d9d26231a15f8d9a6b3e74b3db45512440e3e8 # v1.1.0
       - name: Install pond
-        uses: fish-shop/install-plugin@v2
+        uses: fish-shop/install-plugin@edc7c38b322254439399b061679e7d890574169b # v2.1.1
         with:
           plugin-manager: fisher
           plugins: (pwd)
       - name: Run Fishtape tests
-        uses: fish-shop/run-fishtape-tests@v1
+        uses: fish-shop/run-fishtape-tests@f4e082b2008a91575df5edc72b17cf38d75ea52e # v1.4.1
         with:
           pattern: tests/**.fish
   install:
@@ -46,11 +48,12 @@ jobs:
         plugin-manager: [fisher, oh-my-fish]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       - name: Install fish shell
-        uses: fish-actions/install-fish@v1
+        uses: fish-actions/install-fish@d6d9d26231a15f8d9a6b3e74b3db45512440e3e8 # v1.1.0
       - name: Install pond using ${{ matrix.plugin-manager }}
-        uses: fish-shop/install-plugin@v2
+        uses: fish-shop/install-plugin@edc7c38b322254439399b061679e7d890574169b # v2.1.1
         with:
           plugin-manager: ${{ matrix.plugin-manager }}
           plugins: (pwd)