From 89e7be0a46bb0d5242fd457107ace1406143f77a Mon Sep 17 00:00:00 2001
From: Mario Minardi <mario@tailscale.com>
Date: Wed, 2 Apr 2025 19:25:27 -0600
Subject: [PATCH] .github/workflows: pin GitHub action versions (#631)

Pin versions of GitHub actions that are used in our workflows.

Bumps an instance of actions/checkout from v3.x to v4.x.

Bumps actions/setup-java from v3.x to v4.x.

Updates #cleanup

Signed-off-by: Mario Minardi <mario@tailscale.com>
---
 .github/workflows/android.yml         | 6 +++---
 .github/workflows/go_mod_tidy.yml     | 4 ++--
 .github/workflows/license-headers.yml | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index efbedad..7602419 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -16,12 +16,12 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
-      - uses: actions/setup-go@v5
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
           go-version-file: "go.mod"
       - name: Switch to Java 17 # Note: 17 is pre-installed on ubuntu-latest
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
           distribution: "temurin"
           java-version: "17"
diff --git a/.github/workflows/go_mod_tidy.yml b/.github/workflows/go_mod_tidy.yml
index d6c1dac..f207d83 100644
--- a/.github/workflows/go_mod_tidy.yml
+++ b/.github/workflows/go_mod_tidy.yml
@@ -19,10 +19,10 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
           cache: false
           go-version-file: go.mod
diff --git a/.github/workflows/license-headers.yml b/.github/workflows/license-headers.yml
index 2a78455..5f4f7b5 100644
--- a/.github/workflows/license-headers.yml
+++ b/.github/workflows/license-headers.yml
@@ -14,6 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: check license headers
         run: ./scripts/check_license_headers.sh .