Thomas Eizinger d26df944c0 ci: reference GitHub actions by hash (#7724) ...

To improve supply-chain security, reference all GitHub actions using the
hash of the released tag. GitHub recommends to do this for third-party
actions
(https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions).
In order to make our CI more deterministic, I opted to do it for all our
actions. This means any change to our workflow configuration requires a
source code change and thus passing CI on our end.

Dependabot will automatically issue PRs for these actions and update the
comment with the new version next to them.

Resolves: #2497.

2025-01-12 17:35:52 +00:00

..

action.yml

ci: reference GitHub actions by hash (#7724)

2025-01-12 17:35:52 +00:00