From df9e7bc00e41ea102a2f1232d04edb348fb1598c Mon Sep 17 00:00:00 2001
From: Craig Cooper <github@c9r.dev>
Date: Tue, 14 Jul 2026 13:17:19 +0700
Subject: [PATCH] ci: pin all GitHub Actions to commit SHA, bump to latest

- actions/checkout v6.0.1 -> v7.0.0
- actions/cache/restore, actions/cache/save v4 (unpinned) -> v6.1.0 (pinned)
- docker/setup-buildx-action v3 (unpinned) -> v4.2.0 (pinned)
- docker/metadata-action v5.6.1 -> v6.2.0
- docker/login-action v3.6.0 -> v4.4.0
- docker/build-push-action v6.10.0 -> v7.3.0
---
 .github/workflows/build-deploy.yml   | 22 +++++++++++-----------
 .github/workflows/release-deploy.yml |  4 ++--
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/build-deploy.yml b/.github/workflows/build-deploy.yml
index adb9b8d..6733acc 100644
--- a/.github/workflows/build-deploy.yml
+++ b/.github/workflows/build-deploy.yml
@@ -36,7 +36,7 @@ jobs:
       # Fresh runner DB — no need to restart the db container during testsetup.
       SKIP_DB_RESTART: "True"
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           submodules: recursive
 
@@ -49,7 +49,7 @@ jobs:
       # `pipenv sync` is repeated cold on every triage run. Saved at job end.
       - name: Restore Python venv
         id: venv-cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .adxvenv
           key: adxvenv-${{ runner.os }}-${{ hashFiles('Pipfile.lock') }}
@@ -60,7 +60,7 @@ jobs:
       # React app on every boot. Cache its node_modules on the React yarn.lock.
       - name: Restore unaids React node_modules
         id: react-cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: submodules/ckanext-unaids/ckanext/unaids/react/node_modules
           key: react-nm-${{ runner.os }}-${{ hashFiles('submodules/ckanext-unaids/ckanext/unaids/react/yarn.lock') }}
@@ -120,14 +120,14 @@ jobs:
 
       - name: Save Python venv
         if: always() && steps.venv-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .adxvenv
           key: ${{ steps.venv-cache.outputs.cache-primary-key }}
 
       - name: Save unaids React node_modules
         if: always() && steps.react-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: submodules/ckanext-unaids/ckanext/unaids/react/node_modules
           key: ${{ steps.react-cache.outputs.cache-primary-key }}
@@ -146,30 +146,30 @@ jobs:
     outputs:
       image_tag: ${{ steps.meta.outputs.version }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           submodules: recursive
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.6.1
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ env.ACR_NAME }}.azurecr.io/${{ env.IMAGE_NAME }}
           tags: |
             type=sha,prefix=sha-,format=short
 
       - name: Login to ACR
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ${{ env.ACR_NAME }}.azurecr.io
           username: ${{ secrets.ACR_USERNAME }}
           password: ${{ secrets.ACR_PASSWORD }}
 
       - name: Build and push
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.10.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: deploy/Dockerfile.prod
@@ -194,7 +194,7 @@ jobs:
       name: staging
       url: ${{ env.URL }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Resolve image tag
         id: params
diff --git a/.github/workflows/release-deploy.yml b/.github/workflows/release-deploy.yml
index 8f97a2d..ebf28f9 100644
--- a/.github/workflows/release-deploy.yml
+++ b/.github/workflows/release-deploy.yml
@@ -34,7 +34,7 @@ jobs:
       name: production
       url: ${{ env.URL }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
@@ -54,7 +54,7 @@ jobs:
           echo "source_tag=sha-$SHORT_SHA" >> $GITHUB_OUTPUT
 
       - name: Login to ACR
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ${{ env.ACR_NAME }}.azurecr.io
           username: ${{ secrets.ACR_USERNAME }}