From bc7fcbdbea40ce1b6ff958cc158e0c70738c2105 Mon Sep 17 00:00:00 2001
From: aeneasr <3372410+aeneasr@users.noreply.github.com>
Date: Thu, 13 Aug 2026 09:06:23 +0200
Subject: [PATCH] fix: pin license action dependencies

---
 licenses/check/action.yml |  6 +++---
 licenses/install          | 29 +++++++++++++++++++++--------
 licenses/setup/action.yml | 14 +++++++-------
 3 files changed, 31 insertions(+), 18 deletions(-)

diff --git a/licenses/check/action.yml b/licenses/check/action.yml
index 482f58b..2babf8d 100644
--- a/licenses/check/action.yml
+++ b/licenses/check/action.yml
@@ -3,9 +3,9 @@ runs:
   using: "composite"
   steps:
     - name: Install license scanner
-      run:
-        curl https://raw.githubusercontent.com/ory/ci/master/licenses/install |
-        sh
+      run: |
+        ORY_CI_ROOT="${{ github.action_path }}/../.." \
+          sh "${{ github.action_path }}/../install"
       shell: bash
     - name: Check licenses
       run: .bin/licenses
diff --git a/licenses/install b/licenses/install
index e6672a6..8acafc0 100755
--- a/licenses/install
+++ b/licenses/install
@@ -1,6 +1,22 @@
 #!/bin/sh
 set -e
 
+ORY_CI_REF=${ORY_CI_REF:-747531b2acc027b7308a27722efb2dc6d43377db}
+
+install_asset() {
+	source_path=$1
+	destination=$2
+	mode=$3
+	if [ -n "${ORY_CI_ROOT:-}" ]; then
+		install -m "$mode" "${ORY_CI_ROOT}/licenses/${source_path}" "$destination"
+		return
+	fi
+	curl --fail --location --silent --show-error \
+		"https://raw.githubusercontent.com/ory/ci/${ORY_CI_REF}/licenses/${source_path}" \
+		-o "$destination"
+	chmod "$mode" "$destination"
+}
+
 # Default mono-install to false
 FULL_INSTALL=false
 
@@ -28,12 +44,9 @@ if [ ! -d .bin ]; then
 	mkdir .bin
 fi
 
-curl https://raw.githubusercontent.com/ory/ci/master/licenses/license-engine.sh -o .bin/license-engine.sh
-chmod +x .bin/license-engine.sh
-curl https://raw.githubusercontent.com/ory/ci/master/licenses/licenses -o .bin/licenses
-chmod +x .bin/licenses
-curl https://raw.githubusercontent.com/ory/ci/master/licenses/list-licenses -o .bin/list-licenses
-chmod +x .bin/list-licenses
+install_asset license-engine.sh .bin/license-engine.sh 0755
+install_asset licenses .bin/licenses 0755
+install_asset list-licenses .bin/list-licenses 0755
 
 if [ "$FULL_INSTALL" = true ] || [ -f go.mod ]; then
 	{
@@ -42,7 +55,7 @@ if [ "$FULL_INSTALL" = true ] || [ -f go.mod ]; then
 		echo
 	} 2>/dev/null
 	GOBIN="$(pwd)/.bin" go install github.com/google/go-licenses/v2@v2.0.1
-	curl https://raw.githubusercontent.com/ory/ci/master/licenses/license-template-go.tpl -o .bin/license-template-go.tpl
+	install_asset license-template-go.tpl .bin/license-template-go.tpl 0644
 fi
 
 if [ "$FULL_INSTALL" = true ] || [ -f package.json ]; then
@@ -51,5 +64,5 @@ if [ "$FULL_INSTALL" = true ] || [ -f package.json ]; then
 		echo "Installing the Node license checker ..."
 		echo
 	} 2>/dev/null
-	curl https://raw.githubusercontent.com/ory/ci/master/licenses/license-template-node.json -o .bin/license-template-node.json
+	install_asset license-template-node.json .bin/license-template-node.json 0644
 fi
diff --git a/licenses/setup/action.yml b/licenses/setup/action.yml
index 0b21703..9d9430e 100644
--- a/licenses/setup/action.yml
+++ b/licenses/setup/action.yml
@@ -7,25 +7,25 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         # We must fetch at least the immediate parents so that if this is
         # a pull request then we can checkout the head.
         fetch-depth: 2
         token: ${{ inputs.token || github.token }}
-    - uses: actions/setup-go@v4
+    - uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4
       with:
         go-version: "1.23"
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
       with:
         python-version: "3.13"
-    - uses: actions/setup-node@v2
+    - uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2
       with:
         node-version: "22"
     - run: sudo apt-get install jq
       shell: bash
     - name: Install license scanner
-      run:
-        curl https://raw.githubusercontent.com/ory/ci/master/licenses/install |
-        sh
+      run: |
+        ORY_CI_ROOT="${{ github.action_path }}/../.." \
+          sh "${{ github.action_path }}/../install"
       shell: bash