pin all github action versions using a SHA

lesserwhirls · lesserwhirls · commit a190ee95ed92 · 2026-03-25T16:34:21.000-06:00
diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml
@@ -9,9 +9,9 @@ jobs:
     name: Check fresh compile and assemble of netCDF-Java project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'temurin'
           java-version: |
diff --git a/.github/workflows/docs-tutorials.yml b/.github/workflows/docs-tutorials.yml
@@ -9,16 +9,16 @@ jobs:
     name: netCDF-Java Documentation Code Deprecation Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Java 8, 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'temurin'
           java-version: |
             8
             17
       - name: Cache Gradle packages
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.gradle/caches
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -13,14 +13,14 @@ jobs:
     name: netCDF-Java Documentation Build Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'temurin'
           java-version: '17'
       - name: Cache Gradle packages
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.gradle/caches
@@ -32,7 +32,7 @@ jobs:
         run: ./gradlew buildJekyllSite
       - if: success()
         name: Upload a preview of the rendered html
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: documentation_${{ github.sha }}
           path: docs/build/site
diff --git a/.github/workflows/libaec.yml b/.github/workflows/libaec.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: ${{ matrix.build_env.os }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: 'MathisRosenhauer/libaec'
           ref: 'v1.1.3'
@@ -70,7 +70,7 @@ jobs:
           cp ${{ matrix.build_env.lib }} resources/${{ matrix.build_env.jna_id }}
 
       - name: Upload ${{ matrix.build_env.jna_id }} artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: libaec-${{ matrix.build_env.jna_id }}
           path: ${{ steps.strings.outputs.build-dir }}/resources
@@ -81,7 +81,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: libaec-*
           path: native/resources/
@@ -91,7 +91,7 @@ jobs:
         run: find native/ -type f -exec ls -lh {} \;
 
       - name: Upload merged artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: libaec-native-1.1.3-${{ github.sha }}
           path: native/
diff --git a/.github/workflows/libblosc2.yml b/.github/workflows/libblosc2.yml
@@ -31,7 +31,7 @@ jobs:
         run: |
           echo "build-dir=${{ github.workspace }}/build" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: 'Blosc/c-blosc2'
           ref: "v2.23.1"
@@ -61,7 +61,7 @@ jobs:
           cp -L ${{ matrix.build_env.lib }} resources/${{ matrix.build_env.jna_id }}
 
       - name: Upload ${{ matrix.build_env.jna_id }} artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: libblosc2-${{ matrix.build_env.jna_id }}
           path: ${{ steps.strings.outputs.build-dir }}/resources
@@ -72,7 +72,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: libblosc2-*
           path: native/resources/
@@ -82,7 +82,7 @@ jobs:
         run: find native/ -type f -exec ls -lh {} \;
 
       - name: Upload merged artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: libblosc2-native-2.23.1-${{ github.sha }}
           path: native/
diff --git a/.github/workflows/style.yml b/.github/workflows/style.yml
@@ -9,14 +9,14 @@ jobs:
     name: Code Style Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'temurin'
           java-version: '17'
       - name: Cache Gradle packages
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.gradle/caches
diff --git a/.github/workflows/test-native-compression-aec.yml b/.github/workflows/test-native-compression-aec.yml
@@ -24,23 +24,23 @@ jobs:
     name: netCDF-Java Native Compression Tests (aec)
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup JDK 8, 17
         if: ${{ matrix.os == 'ubuntu-24.04' || matrix.os == 'macos-15-intel' }}
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'temurin'
           java-version: |
             8
             17
       - name: Setup JDK 21
         if: ${{ matrix.os != 'ubuntu-24.04' && matrix.os != 'macos-15-intel' }}
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'temurin'
           java-version: '21'
       - name: Cache Gradle packages
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.gradle/caches
@@ -56,7 +56,7 @@ jobs:
       - name: Run libaec JNA tests (JDK 21 tests)
         if: ${{ matrix.os != 'ubuntu-24.04' && matrix.os != 'macos-15-intel' }}
         run: ./gradlew clean :libaec-jna:test21
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: failure()
         with:
           name: NativeCompression_JUnit_Results_${{ github.sha }}_-${{ matrix.os }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -14,10 +14,10 @@ jobs:
         java-version: [8, 11, 17, 21, 25]
         java-vendor: ['temurin', 'corretto']
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Build with ${{ matrix.java-vendor }} 17 and run tests with ${{ matrix.java-vendor }} 8
         if: ${{ matrix.java-version == 8 }}
-        uses: Unidata/thredds-test-action@v4
+        uses: Unidata/thredds-test-action@98125ad3bd0b264d30bcf494228e1d0c897a67c0 # v4
         with:
           java-vendor: ${{ matrix.java-vendor }}
           java-version: 17
@@ -27,7 +27,7 @@ jobs:
           TEST_JDK: /usr/thredds-test-environment/${{ matrix.java-vendor }}8
       - name: Build with ${{ matrix.java-vendor }} 17 and run tests with ${{ matrix.java-vendor }} ${{ matrix.java-version }}
         if: ${{ matrix.java-version != 8 }}
-        uses: Unidata/thredds-test-action@v4
+        uses: Unidata/thredds-test-action@98125ad3bd0b264d30bcf494228e1d0c897a67c0 # v4
         with:
           java-vendor: ${{ matrix.java-vendor }}
           java-version: 17
@@ -38,7 +38,7 @@ jobs:
       - name: Cleanup build-logic-ncj build directory
         if: failure()
         run: sudo rm -rf build-logic-ncj/build/
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: failure()
         with:
           name: netCDF-Java_JUnit_Results_${{ github.sha }}_${{ matrix.java-vendor }}-${{ matrix.java-version }}
