[openssh-commits] [openssh] 01/03: ci: pin GitHub Actions to full commit SHAs

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

dtucker pushed a commit to branch master
in repository openssh.

commit 983096a7b27eaf789b5ceb321867d4511ba779c3
Author: El Mehdi Abenhazou <mehdiananas007 at gmail.com>
AuthorDate: Wed Jun 3 02:02:30 2026 +0100

    ci: pin GitHub Actions to full commit SHAs
    
    Pinning actions/checkout, actions/upload-artifact, and
    cygwin/cygwin-install-action to their full commit SHA instead of
    mutable branch/tag references (main, master).
    
    Using mutable refs means a compromised or malicious update to the
    action repository could silently alter the workflow behavior.
    Pinning to SHA makes the exact version immutable and auditable.
    
    Signed-off-by: El Mehdi Abenhazou <mehdiananas007 at gmail.com>
---
 .github/workflows/c-cpp.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml
index 9d293d7bb..4ddaf0fc1 100644
--- a/.github/workflows/c-cpp.yml
+++ b/.github/workflows/c-cpp.yml
@@ -134,10 +134,10 @@ jobs:
     - name: install cygwin
       id: cygwin_install
       if: ${{ startsWith(matrix.target, 'windows') }}
-      uses: cygwin/cygwin-install-action at master
+      uses: cygwin/cygwin-install-action at 4ef15ca7fd18a18f1000989fcfd968e06d146ce8 # master
       env:
         CYGWIN: "winsymlinks:native"
-    - uses: actions/checkout at main
+    - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # main
     - name: setup CI system
       run: |
         sh -c "timeout 1200 .github/setup_ci.sh ${{ matrix.config }} ${{ matrix.target }} || .github/setup_ci.sh ${{ matrix.config }} ${{ matrix.target }}"
@@ -148,7 +148,7 @@ jobs:
     - name: configure
       run: sh ./.github/configure.sh ${{ matrix.config }}
     - name: save config
-      uses: actions/upload-artifact at main
+      uses: actions/upload-artifact at 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
       with:
         name: ${{ matrix.target }}-${{ matrix.config }}-config
         path: config.h
@@ -176,7 +176,7 @@ jobs:
       run: sh -c "for i in regress/failed*.log; do echo ====; echo logfile $i; echo =====; cat $i; done"
     - name: save logs
       if: failure()
-      uses: actions/upload-artifact at main
+      uses: actions/upload-artifact at 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
       with:
         name: ${{ matrix.target }}-${{ matrix.config }}-logs
         path: |

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.