From 696410fb86172f9fc02fc7f6244abd519631536d Mon Sep 17 00:00:00 2001
From: mirkosalvato1-ctrl
 <227404546+mirkosalvato1-ctrl@users.noreply.github.com>
Date: Thu, 23 Jul 2026 19:11:51 +0200
Subject: [PATCH] ci: pin GitHub Actions to commit SHAs (11 pin(s))

---
 .github/workflows/build-publish-cli.yml          | 2 +-
 .github/workflows/docker-build-push-ai.yml       | 6 +++---
 .github/workflows/docker-build-push-frontend.yml | 6 +++---
 .github/workflows/docker-build-push-server.yml   | 6 +++---
 .github/workflows/e2e-system-tests.yml           | 2 +-
 5 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/build-publish-cli.yml b/.github/workflows/build-publish-cli.yml
index 2085a179..0fdc18ed 100644
--- a/.github/workflows/build-publish-cli.yml
+++ b/.github/workflows/build-publish-cli.yml
@@ -89,7 +89,7 @@ jobs:
           merge-multiple: true
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2
         with:
           tag_name: ${{ steps.get_version.outputs.version }}
           name: Release ${{ steps.get_version.outputs.version }}
diff --git a/.github/workflows/docker-build-push-ai.yml b/.github/workflows/docker-build-push-ai.yml
index 892c3c73..da1becf9 100644
--- a/.github/workflows/docker-build-push-ai.yml
+++ b/.github/workflows/docker-build-push-ai.yml
@@ -32,12 +32,12 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
         with:
           install: true
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
@@ -74,7 +74,7 @@ jobs:
           echo "DOCKER_HUB_USERNAME=${{ secrets.DOCKER_HUB_USERNAME }}" >> $GITHUB_ENV
 
       - name: Build and push ai
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25  # v5
         with:
           context: ./package/ai
           file: ./package/ai/${{ matrix.dockerfile }}
diff --git a/.github/workflows/docker-build-push-frontend.yml b/.github/workflows/docker-build-push-frontend.yml
index 955ba8e2..ad5f6702 100644
--- a/.github/workflows/docker-build-push-frontend.yml
+++ b/.github/workflows/docker-build-push-frontend.yml
@@ -17,12 +17,12 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
         with:
           install: true
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
@@ -49,7 +49,7 @@ jobs:
           echo "DOCKER_HUB_USERNAME=${{ secrets.DOCKER_HUB_USERNAME }}" >> $GITHUB_ENV
 
       - name: Build and push frontend
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25  # v5
         with:
           context: ./package/website
           platforms: linux/amd64,linux/arm64
diff --git a/.github/workflows/docker-build-push-server.yml b/.github/workflows/docker-build-push-server.yml
index 85fd2a7d..17c88a08 100644
--- a/.github/workflows/docker-build-push-server.yml
+++ b/.github/workflows/docker-build-push-server.yml
@@ -17,12 +17,12 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
         with:
           install: true
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
@@ -49,7 +49,7 @@ jobs:
           echo "DOCKER_HUB_USERNAME=${{ secrets.DOCKER_HUB_USERNAME }}" >> $GITHUB_ENV
 
       - name: Build and push server
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25  # v5
         with:
           context: ./package/server
           platforms: linux/amd64,linux/arm64
diff --git a/.github/workflows/e2e-system-tests.yml b/.github/workflows/e2e-system-tests.yml
index 677d9b91..695f2518 100644
--- a/.github/workflows/e2e-system-tests.yml
+++ b/.github/workflows/e2e-system-tests.yml
@@ -23,7 +23,7 @@ jobs:
         node-version: '20'
 
     - name: Install pnpm
-      uses: pnpm/action-setup@v3
+      uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d  # v3
       with:
         version: 9
         run_install: false