From 6c254c0783111894652b2e92866a00cb94881a18 Mon Sep 17 00:00:00 2001
From: Willem Jiang <willem.jiang@gmail.com>
Date: Mon, 7 Jul 2025 08:18:17 +0800
Subject: [PATCH] fix: spine the github hash on the third party actions (#392)

---
 .github/workflows/container.yaml | 6 +++---
 .github/workflows/lint.yaml      | 2 +-
 .github/workflows/unittest.yaml  | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/container.yaml b/.github/workflows/container.yaml
index e5c6e5f..2e7e99e 100644
--- a/.github/workflows/container.yaml
+++ b/.github/workflows/container.yaml
@@ -67,19 +67,19 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 #v3.4.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 #v5.7.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 #v6.18.0
         with:
           context: web
           file: web/Dockerfile
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 6e6316d..b2b1951 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -16,7 +16,7 @@ jobs:
     - uses: actions/checkout@v3
 
     - name: Install the latest version of uv
-      uses: astral-sh/setup-uv@v5
+      uses: stral-sh/setup-uv@bd01e18f51369ad5a26f1651c3cb451d3417e3bba #v6.3.1
       with:
         version: "latest"
 
diff --git a/.github/workflows/unittest.yaml b/.github/workflows/unittest.yaml
index c8902b2..68351fe 100644
--- a/.github/workflows/unittest.yaml
+++ b/.github/workflows/unittest.yaml
@@ -16,7 +16,7 @@ jobs:
     - uses: actions/checkout@v3
 
     - name: Install the latest version of uv
-      uses: astral-sh/setup-uv@v5
+      uses: stral-sh/setup-uv@bd01e18f51369ad5a26f1651c3cb451d3417e3bba #v6.3.1
       with:
         version: "latest"