From: Ernesto Puerta <epuertat@redhat.com>
Date: Thu, 2 Oct 2025 17:54:34 +0000 (+0200)
Subject: .github: pin GH Actions to SHA-1 commit
X-Git-Tag: v18.2.8~9^2
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=afafbf0e336856630a5b8c466ea768c68ed2acd1;p=ceph.git

.github: pin GH Actions to SHA-1 commit

Fixes: https://tracker.ceph.com/issues/73337

Signed-off-by: Ernesto Puerta <epuertat@redhat.com>
---

diff --git a/.github/workflows/create-backport-trackers.yml b/.github/workflows/create-backport-trackers.yml
index b3525d9e94e1..9160f02613cb 100644
--- a/.github/workflows/create-backport-trackers.yml
+++ b/.github/workflows/create-backport-trackers.yml
@@ -39,7 +39,7 @@ jobs:
       - uses: Bhacaz/checkout-files@e3e34e7daef91a5f237485bb88a260aee4be29dd
         with:
           files: src/script/backport-create-issue src/script/requirements.backport-create-issue.txt
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
         with:
           python-version: '>=3.6'
           cache: 'pip'
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 2de5de3f1773..bceede11d8da 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -9,7 +9,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v5
+      - uses: actions/stale@f7176fd3007623b69d27091f9b9d4ab7995f0a06 # v5
         with:
           # PAT for GitHub API authentication
           repo-token: "${{ secrets.GITHUB_TOKEN }}"