From 55b3d9490e2f4f6c6e1a671eed189d50a6057456 Mon Sep 17 00:00:00 2001 From: Rob Ede Date: Sat, 4 Apr 2026 09:48:30 +0300 Subject: [PATCH] ci: pin action refs as recommended by https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions --- .github/workflows/build.yml | 10 +++++----- .github/workflows/coverage.yml | 6 +++--- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 7ae94cc..057c277 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -24,12 +24,12 @@ jobs: - nightly steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Install ${{ matrix.rust }} Rust run: rustup default ${{ matrix.rust }} - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 # Verify that features work by themselves # Features should not interfere with each other @@ -54,7 +54,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Build documentation and check intra-doc links env: @@ -66,7 +66,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 # We use an unstable rustfmt feature and we thus need the # nightly channel to enforce the formatting. @@ -77,4 +77,4 @@ jobs: run: rustup component add rustfmt - name: Check Formatting - uses: dprint/check@v2.2 + uses: dprint/check@2f1cf31537886c3bfb05591c031f7744e48ba8a1 # v2.2 diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 6c532eb..da4a827 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -14,10 +14,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Run cargo-tarpaulin - uses: actions-rs/tarpaulin@v0.1 + uses: actions-rs/tarpaulin@044a1e5bdace8dd2f727b1af63c1d9a1d3572068 # v0.1.3 - name: Upload to codecov.io - uses: codecov/codecov-action@v1 + uses: codecov/codecov-action@29386c70ef20e286228c72b668a06fd0e8399192 # v1.5.2