From e8f4a500bbeb14c62fecd40eddfb984a4dc3aa33 Mon Sep 17 00:00:00 2001 From: MacOS Date: Tue, 14 Jul 2026 13:55:33 +0200 Subject: [PATCH 1/7] build(docs-workflow): pin checkout action with commit hash --- .github/workflows/docs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index a2fdb431..6b310914 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -39,7 +39,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # JDK 25 matches the version used by every other workflow in # this repo. Runs on the RUNNER, not inside the Docker From 91b7228338f0f185f4fd659bc18cd645e0bc099d Mon Sep 17 00:00:00 2001 From: MacOS Date: Tue, 14 Jul 2026 13:56:47 +0200 Subject: [PATCH 2/7] build(docs-workflow): pin setup-java workflow with commit hash --- .github/workflows/docs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 6b310914..b998654c 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -46,7 +46,7 @@ jobs: # container, so the Gradle wrapper cache works and generateDocs # / dokkaGenerate see the right JDK. - name: Set up JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0 with: distribution: temurin java-version: '25' From 21486f26f02ab1d5c8d842886db5c6538e99f22a Mon Sep 17 00:00:00 2001 From: MacOS Date: Tue, 14 Jul 2026 13:57:59 +0200 Subject: [PATCH 3/7] build(docs-workflow): pin cache action with commit hash --- .github/workflows/docs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index b998654c..2d149c7d 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -52,7 +52,7 @@ jobs: java-version: '25' - name: Cache Gradle - uses: actions/cache@v6 + uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 with: path: | ~/.gradle/caches From bf01640ccfe1995d74f03ca10135a7e71d02c930 Mon Sep 17 00:00:00 2001 From: MacOS Date: Tue, 14 Jul 2026 13:59:26 +0200 Subject: [PATCH 4/7] build(docs-workflow): pin setup-buildx-action with commit hash --- .github/workflows/docs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 2d149c7d..4b3ae8ff 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -71,7 +71,7 @@ jobs: run: ./gradlew --no-daemon generateDocs dokkaGenerate - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 # The Chromium layer makes the image ~400 MB. First build is # ~3–5 minutes; subsequent runs are sub-minute via the GHA From 923dcc04277cd1c92eea73e9d3d4a91cf2790a7a Mon Sep 17 00:00:00 2001 From: MacOS Date: Tue, 14 Jul 2026 14:01:14 +0200 Subject: [PATCH 5/7] build(docs-workflow): pin build-push-action with commit hash --- .github/workflows/docs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 4b3ae8ff..db36f292 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -78,7 +78,7 @@ jobs: # cache. Transformers skipped caching here — this workflow # improves on that. - name: Build Antora image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.0.0 with: context: docs/.docker tags: skainet-antora:local From dd7a0eee116b35080b927de1d17a2a5b1ce100fa Mon Sep 17 00:00:00 2001 From: MacOS Date: Tue, 14 Jul 2026 14:02:56 +0200 Subject: [PATCH 6/7] build(docs-workflow): pin upload-pages-artifact with commit hash --- .github/workflows/docs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index db36f292..6ebd8777 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -112,7 +112,7 @@ jobs: run: ./gradlew --no-daemon bundleDokkaIntoSite - name: Upload artifact - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: docs/build/site From 1ba04b8b2d68db01485184d27526cf0d06456016 Mon Sep 17 00:00:00 2001 From: MacOS Date: Tue, 14 Jul 2026 14:03:57 +0200 Subject: [PATCH 7/7] build(docs-workflow): pin deploy-pages action with commit hash --- .github/workflows/docs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 6ebd8777..f6dfa47d 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -127,4 +127,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0