From 896a1fb711c9fc2713fd8f2648b825979694082b Mon Sep 17 00:00:00 2001
From: Haitao Pan <manbuzhe2009@qq.com>
Date: Wed, 18 Mar 2026 23:26:35 +0800
Subject: [PATCH] chore(ci): pin GH actions to shas

---
 .github/workflows/build-images.yml             | 18 +++++++++---------
 .github/workflows/check-image.yaml             |  2 +-
 .../service_release_frontend-deploy.yml        | 10 +++++-----
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/build-images.yml b/.github/workflows/build-images.yml
index 9c09118..84a29a2 100644
--- a/.github/workflows/build-images.yml
+++ b/.github/workflows/build-images.yml
@@ -84,9 +84,9 @@ jobs:
           - { name: dashboard, workdir: ., dockerfile: Dockerfile }
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
 
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -99,14 +99,14 @@ jobs:
           image: ${{ env.REGISTRY }}/${{ env.ORG }}/${{ matrix.service.name }}
 
       - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
 
       - name: Clone knowledge content
         run: git clone https://github.com/Cloud-Neutral-Workshop/knowledge.git knowledge
 
       - name: Build Service Image (per-arch)
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
         with:
           context: ${{ matrix.service.workdir }}
           file: ${{ matrix.service.dockerfile }}
@@ -146,7 +146,7 @@ jobs:
           - { name: dashboard }
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
 
       - uses: actions/download-artifact@v4
         with:
@@ -206,9 +206,9 @@ jobs:
           - docker.io
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
 
       - uses: actions/download-artifact@v4
         with:
@@ -230,7 +230,7 @@ jobs:
         with:
           image: ${{ env.REGISTRY }}/${{ env.ORG }}/dashboard
 
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
         if: matrix.registry == 'ghcr.io'
         with:
           registry: ${{ matrix.registry }}
@@ -257,7 +257,7 @@ jobs:
 
       - name: Login to Docker Hub
         if: matrix.registry == 'docker.io'
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
         with:
           registry: docker.io
           username: ${{ secrets.DOCKERHUB_USERNAME }}
diff --git a/.github/workflows/check-image.yaml b/.github/workflows/check-image.yaml
index ac089e9..9475579 100644
--- a/.github/workflows/check-image.yaml
+++ b/.github/workflows/check-image.yaml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Authenticate to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/service_release_frontend-deploy.yml b/.github/workflows/service_release_frontend-deploy.yml
index 4d919e8..5d5d2e9 100644
--- a/.github/workflows/service_release_frontend-deploy.yml
+++ b/.github/workflows/service_release_frontend-deploy.yml
@@ -49,21 +49,21 @@ jobs:
     needs: prepare
     environment: production
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
 
       - name: Clone knowledge content
         run: git clone --depth=1 https://github.com/Cloud-Neutral-Workshop/knowledge.git knowledge
 
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ github.token }}
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
 
       - name: Build and push frontend image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
         with:
           context: .
           file: Dockerfile
@@ -99,7 +99,7 @@ jobs:
       - build
     environment: production
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
 
       - name: Deploy frontend stack
         env: