.github: pin GH Actions to SHA-1 commit

Fixes: https://tracker.ceph.com/issues/73337
Signed-off-by: Ernesto Puerta <epuertat@redhat.com>

diff --git a/.github/workflows/create-backport-trackers.yml b/.github/workflows/create-backport-trackers.yml
index b3525d9e94e102e505d8749d4d7ee6c401aa4b0d..9160f02613cb31ddef554e77a23379b2d3f282ee 100644 (file)
--- a/.github/workflows/create-backport-trackers.yml
+++ b/.github/workflows/create-backport-trackers.yml
@@ -39,7 +39,7 @@ jobs:
       - uses: Bhacaz/checkout-files@e3e34e7daef91a5f237485bb88a260aee4be29dd
         with:
           files: src/script/backport-create-issue src/script/requirements.backport-create-issue.txt
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
         with:
           python-version: '>=3.6'
           cache: 'pip'

diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 2de5de3f17735bf174c3a58747e573f51494c602..bceede11d8da0764589cad1bfef93d8b68a8dedd 100644 (file)
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -9,7 +9,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v5
+      - uses: actions/stale@f7176fd3007623b69d27091f9b9d4ab7995f0a06 # v5
         with:
           # PAT for GitHub API authentication
           repo-token: "${{ secrets.GITHUB_TOKEN }}"