tree 48f801d642ec938321c00e80bc25e43570e689bb
parent ca50fa491dab615b1acd75b6a2e009319a0e4bfa
author Scott Todd <scotttodd@google.com> 1651531022 -0700
committer GitHub <noreply@github.com> 1651531022 -0700
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJicF0OCRBK7hj4Ov3rIwAARmYIAEr7ZnbF5mCY0vxTSZIGMaoK
 BbRPxDWw5+fV/H85utxft7ObHbi6b+B+8GNVyEr5Fh15Gg9NLpw9c/VlIiCsifLg
 5CX+RngOo2E81Pft2VVsj0DR7JWna08BKmUBFJ1id3ch6yp24bKzTxqKJLTBQb8l
 Bv8ldG6ZwN9xvXnuyvshVJ370EehpuIE/+fjJ0NUuYeoRdN+P8slfyQzBL6DC/jm
 5TbWumOz2HQ1WayC2m1CsVY9EHqrnqhecEGkEtn/vffHqJu4a2/kU63UJ5kLyp+/
 7813pXbHLgCgamSTqCx403a4EJF6edHUiMM+jkEDNEAAC9XabnAPIf61iIskMVk=
 =XD0l
 -----END PGP SIGNATURE-----
 

Pin GitHub Action versions to specific commits, not tags. (#8997)

The policy we followed changed for this at some point, from allowing tagged releases to requiring specific commits: https://opensource.google/documentation/reference/github/services#actions

> When using a third-party action (one not hosted in a Google-managed org), a fixed version of the action MUST be used by [specifying a specific commit](https://help.github.com/en/github/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions#jobsjob_idstepsuses), rather than a branch like "master", or a tagged release, which can be overwritten by any maintainer of the action. Docker images should always be run at a fixed version rather than "latest".

I searched each action for the commits we were using anyways (so not upgrading from v2 to v3, for example), but some drift may have occurred. If this breaks any of our workflows after merging, we can take a closer look.