From 635e7ebb5e83910b841247e3ffca83c4284a9b7c Mon Sep 17 00:00:00 2001 From: Calin Teodor Date: Wed, 14 Oct 2026 12:48:31 -0700 Subject: [PATCH 1/2] ci: pin third-party actions in deploy-appstore-meta.yml to commit SHAs Co-Authored-By: Claude Opus 5.5 --- .github/workflows/deploy-appstore-meta.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy-appstore-meta.yml b/.github/workflows/deploy-appstore-meta.yml index 3a87522..b77f113 100644 --- a/.github/workflows/deploy-appstore-meta.yml +++ b/.github/workflows/deploy-appstore-meta.yml @@ -35,12 +35,12 @@ jobs: echo "enabled=false" >> "$GITHUB_OUTPUT" fi - - uses: google-github-actions/auth@v2 + - uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2 if: steps.gate.outputs.enabled == 'true' with: credentials_json: ${{ secrets.APPSTORE_META_GCP_SA_KEY }} - - uses: google-github-actions/setup-gcloud@v2 + - uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2 if: steps.gate.outputs.enabled == 'true' - name: Rebuild and restart metadata API From b78e2abbc8f11984fd6b0c44eb7b0fe1d2abe2f2 Mon Sep 17 00:00:00 2001 From: Calin Teodor Date: Wed, 14 Oct 2026 12:48:34 -0700 Subject: [PATCH 2/2] ci: pin third-party actions in deploy.yml to commit SHAs Co-Authored-By: Claude Opus 5.5 --- .github/workflows/deploy.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 853852f..abb1c8a 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -47,12 +47,12 @@ jobs: echo "enabled=false" >> "$GITHUB_OUTPUT" fi - - uses: google-github-actions/auth@v2 + - uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2 if: steps.gate.outputs.enabled == 'true' with: credentials_json: ${{ secrets.GCP_SA_KEY }} - - uses: google-github-actions/setup-gcloud@v2 + - uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2 if: steps.gate.outputs.enabled == 'true' - name: Pull, rebuild, restart on the VM