From c6d152a07438eee83e29349108dd7e3ba9c6ba16 Mon Sep 17 00:00:00 2001
From: Willem Jiang <willem.jiang@gmail.com>
Date: Wed, 20 Aug 2025 13:52:00 +0800
Subject: [PATCH] fix: using commit hash as the action version (#519)

Co-authored-by: Willem Jiang <143703838+willem-bd@users.noreply.github.com>
---
 .github/workflows/container.yaml | 6 +++---
 .github/workflows/lint.yaml      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/container.yaml b/.github/workflows/container.yaml
index 2e7e99e..3de6647 100644
--- a/.github/workflows/container.yaml
+++ b/.github/workflows/container.yaml
@@ -25,19 +25,19 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 #v3.4.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 #v5.7.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 #v6.18.0
         with:
           context: .
           file: Dockerfile
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 28c00ce..0d9cc78 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -16,7 +16,7 @@ jobs:
     - uses: actions/checkout@v3
 
     - name: Install the latest version of uv
-      uses: astral-sh/setup-uv@v6.3.1
+      uses: astral-sh/setup-uv@d9e0f98d3fc6adb07d1e3d37f3043649ddad06a1 #v6.5.0
       with:
         version: "latest"