From 3d2832a5d5bc32eb6a65fa685c1bb7cc75dd7fa3 Mon Sep 17 00:00:00 2001
From: Clement Tsang <34804052+ClementTsang@users.noreply.github.com>
Date: Sun, 30 Nov 2025 18:42:39 -0500
Subject: [PATCH] ci: require all actions to be pinned (#1893)

---
 .github/workflows/build_releases.yml | 6 +++---
 .github/workflows/ci.yml             | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/build_releases.yml b/.github/workflows/build_releases.yml
index 16f5177e..a52c12a7 100644
--- a/.github/workflows/build_releases.yml
+++ b/.github/workflows/build_releases.yml
@@ -159,7 +159,7 @@ jobs:
           echo "$HOME/.cargo/bin" >> $GITHUB_PATH
 
       - name: Build
-        uses: ClementTsang/cargo-action@v0.0.7
+        uses: ClementTsang/cargo-action@2438cc5f3ba4e971289fffca2a00dedea6911f14 # v0.0.7
         env:
           BTM_GENERATE: true
           BTM_BUILD_RELEASE_CALLER: ${{ inputs.caller }}
@@ -486,7 +486,7 @@ jobs:
 
       # TODO: Could I use the previous jobs to skip this call?
       - name: Build
-        uses: ClementTsang/cargo-action@v0.0.7
+        uses: ClementTsang/cargo-action@2438cc5f3ba4e971289fffca2a00dedea6911f14 # v0.0.7
         env:
           BTM_GENERATE: true
           BTM_BUILD_RELEASE_CALLER: ${{ inputs.caller }}
@@ -597,7 +597,7 @@ jobs:
 
       # TODO: Could I use the previous jobs to skip this call?
       - name: Build
-        uses: ClementTsang/cargo-action@v0.0.7
+        uses: ClementTsang/cargo-action@2438cc5f3ba4e971289fffca2a00dedea6911f14 # v0.0.7
         env:
           BTM_GENERATE: true
           BTM_BUILD_RELEASE_CALLER: ${{ inputs.caller }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 07a29d69..cac4d1db 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -111,7 +111,7 @@ jobs:
 
       # TODO: add junit output using nextest for codecov (https://docs.codecov.com/docs/test-analytics)
       - name: Run tests
-        uses: ClementTsang/cargo-action@v0.0.7
+        uses: ClementTsang/cargo-action@2438cc5f3ba4e971289fffca2a00dedea6911f14 # v0.0.7
         with:
           command: test
           args: --no-fail-fast --locked ${{ matrix.features }} --target=${{ matrix.info.target }} -- --nocapture --quiet
@@ -121,7 +121,7 @@ jobs:
           RUST_BACKTRACE: full
 
       - name: Run clippy
-        uses: ClementTsang/cargo-action@v0.0.7
+        uses: ClementTsang/cargo-action@2438cc5f3ba4e971289fffca2a00dedea6911f14 # v0.0.7
         with:
           command: clippy
           args: ${{ matrix.features }} --all-targets --workspace --target=${{ matrix.info.target }} -- -D warnings
@@ -258,7 +258,7 @@ jobs:
           cache-all-crates: true
 
       - name: Clippy (default features)
-        uses: ClementTsang/cargo-action@v0.0.7
+        uses: ClementTsang/cargo-action@2438cc5f3ba4e971289fffca2a00dedea6911f14 # v0.0.7
         if: ${{ matrix.info.no-default-features != true }}
         with:
           command: clippy
@@ -267,7 +267,7 @@ jobs:
           cross-version: ${{ matrix.info.cross-version || '0.2.5' }}
 
       - name: Clippy (no features enabled)
-        uses: ClementTsang/cargo-action@v0.0.7
+        uses: ClementTsang/cargo-action@2438cc5f3ba4e971289fffca2a00dedea6911f14 # v0.0.7
         if: ${{ matrix.info.no-default-features == true  }}
         with:
           command: clippy