From f5a84ed5e2977803c7c0f2339543b3936aa57c1d Mon Sep 17 00:00:00 2001
From: Oskar Eichler <oskar@songstats.com>
Date: Fri, 4 Sep 2026 00:45:27 +0700
Subject: [PATCH] Pin workflow actions to immutable revisions

---
 .github/workflows/binary-gems.yml | 24 ++++++++++++------------
 .github/workflows/source-gem.yml  | 12 ++++++------
 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/binary-gems.yml b/.github/workflows/binary-gems.yml
index b66c46978..558715b93 100644
--- a/.github/workflows/binary-gems.yml
+++ b/.github/workflows/binary-gems.yml
@@ -35,9 +35,9 @@ jobs:
           - platform: "x86_64-darwin"
           - platform: "arm64-darwin"
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: "3.3"
       - run: bundle install
@@ -53,7 +53,7 @@ jobs:
         run: bundle exec rake gem:native:${{ matrix.platform }}
 
       - name: Upload binary gem
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: binary-gem-${{ matrix.platform }}
           path: pkg/*.gem
@@ -101,10 +101,10 @@ jobs:
     env:
       PGVERSION: ${{ matrix.PGVERSION }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Ruby
         if: matrix.platform != 'x86-mingw32'
-        uses: ruby/setup-ruby-pkgs@v1
+        uses: ruby/setup-ruby-pkgs@2233d39c1315c667a2970436418b520a6300124e # v1.33.5
         with:
           ruby-version: ${{ matrix.ruby }}
           apt-get: "postgresql" # Ubuntu
@@ -123,7 +123,7 @@ jobs:
           echo "C:/msys64/$env:MSYSTEM_PREFIX/bin"  | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
 
       - name: Download gem from build job
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: binary-gem-${{ matrix.platform }}
 
@@ -200,9 +200,9 @@ jobs:
 
     runs-on: ${{ matrix.os || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download gem-${{ matrix.gem_platform }}
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: binary-gem-${{ matrix.gem_platform }}
       - name: Build image and Run tests
@@ -221,9 +221,9 @@ jobs:
 
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download gem-${{ matrix.gem_platform }}
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: binary-gem-${{ matrix.gem_platform }}
       - name: Build image and Run tests
@@ -244,9 +244,9 @@ jobs:
 
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download gem-${{ matrix.gem_platform }}
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: binary-gem-${{ matrix.gem_platform }}
       - name: Build image and Run tests
diff --git a/.github/workflows/source-gem.yml b/.github/workflows/source-gem.yml
index 8c4b2ff5f..33487b924 100644
--- a/.github/workflows/source-gem.yml
+++ b/.github/workflows/source-gem.yml
@@ -20,9 +20,9 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: "3.2"
 
@@ -30,7 +30,7 @@ jobs:
         run: gem build pg.gemspec
 
       - name: Upload source gem
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: source-gem
           path: "*.gem"
@@ -82,9 +82,9 @@ jobs:
       MAKE: make -j2 V=1
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ matrix.ruby }}
 
@@ -95,7 +95,7 @@ jobs:
           gcc -v
 
       - name: Download gem from build job
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: source-gem