upbound · ytsarev · Nov 22, 2025 · Nov 21, 2025
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -40,10 +40,10 @@ jobs:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6

      - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: false  # The golangci-lint action does its own caching.
@@ -52,18 +52,18 @@ jobs:
        run: go mod tidy && git diff --exit-code go.mod go.sum

      - name: Lint
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@e7fa5ac41e1cf5b7d48e45e42232ce7ada589601 # v9
        with:
          version: ${{ env.GOLANGCI_VERSION }}

  unit-test:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6

      - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
        with:
          go-version: ${{ env.GO_VERSION }}

@@ -84,24 +84,24 @@ jobs:
          - arm64
    steps:
      - name: Setup QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
        with:
          platforms: all

      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
        with:
          version: ${{ env.DOCKER_BUILDX_VERSION }}
          install: true

      - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6

      # We ask Docker to use GitHub Action's native caching support to speed up
      # the build, per https://docs.docker.com/build/cache/backends/gha/.
      - name: Build Runtime
        id: image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
        with:
          context: .
          platforms: linux/${{ matrix.arch }}
@@ -119,7 +119,7 @@ jobs:
        run: ./crossplane xpkg build --package-file=${{ matrix.arch }}.xpkg --package-root=package/ --embed-runtime-image-tarball=runtime-${{ matrix.arch }}.tar

      - name: Upload Single-Platform Package
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
        with:
          name: package-${{ matrix.arch }}
          path: "*.xpkg"
@@ -135,10 +135,10 @@ jobs:
      - build
    steps:
      - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6

      - name: Download Single-Platform Packages
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
        with:
          path: .
          merge-multiple: true
@@ -148,7 +148,7 @@ jobs:
        run: "curl -sL https://raw.githubusercontent.com/crossplane/crossplane/master/install.sh | sh"

      - name: Login to Upbound
-        uses: docker/login-action@v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
        if: env.XPKG_ACCESS_ID != ''
        with:
          registry: xpkg.upbound.io

diff --git a/.github/workflows/tag.yml b/.github/workflows/tag.yml
@@ -16,7 +16,7 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6

      - name: Create Tag
        uses: negz/create-tag@39bae1e0932567a58c20dea5a1a0d18358503320 # v1