chore(deps): Pin dependencies (#2456)

cq-bot · web-flow · commit 661f722e1b45 · 2026-03-25T11:20:35.000Z
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/cache](https://redirect.github.com/actions/cache) | action | pinDigest | → `6682284` | | [actions/checkout](https://redirect.github.com/actions/checkout) | action | pinDigest | → `de0fac2` | | [actions/github-script](https://redirect.github.com/actions/github-script) | action | pinDigest | → `ed59741` | | [actions/setup-go](https://redirect.github.com/actions/setup-go) | action | pinDigest | → `4b73464` | | [actions/upload-artifact](https://redirect.github.com/actions/upload-artifact) | action | pinDigest | → `b7c566a` | | [amannn/action-semantic-pull-request](https://redirect.github.com/amannn/action-semantic-pull-request) | action | pinDigest | → `48f2562` | | [dawidd6/action-download-artifact](https://redirect.github.com/dawidd6/action-download-artifact) | action | pinDigest | → `fe9d59c` | | [golangci/golangci-lint-action](https://redirect.github.com/golangci/golangci-lint-action) | action | pinDigest | → `1e7e51e` | | [googleapis/release-please-action](https://redirect.github.com/googleapis/release-please-action) | action | pinDigest | → `16a9c90` | | [haya14busa/action-workflow_run-status](https://redirect.github.com/haya14busa/action-workflow_run-status) | action | pinDigest | → `967ed83` | | [netlify/delta-action](https://redirect.github.com/netlify/delta-action) | action | pinDigest | → `1195810` | | [nosborn/github-action-markdown-cli](https://redirect.github.com/nosborn/github-action-markdown-cli) | action | pinDigest | → `508d6ce` | | [peter-evans/create-pull-request](https://redirect.github.com/peter-evans/create-pull-request) | action | pinDigest | → `c0f553f` | | [stefanzweifel/git-auto-commit-action](https://redirect.github.com/stefanzweifel/git-auto-commit-action) | action | pinDigest | → `04702ed` | --- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month ( * 0-3 1 * * ) (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/renovatebot/renovate).
diff --git a/.github/workflows/gen_coverage_report.yml b/.github/workflows/gen_coverage_report.yml
@@ -18,17 +18,17 @@ jobs:
       id-token: write
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           token: ${{ secrets.GH_CQ_BOT }}
       - name: Set up Go 1.x
         id: setup-go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
         with:
           go-version: "1.26"
           cache: false
       - name: Cache Go modules
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/go/pkg/mod
@@ -41,7 +41,7 @@ jobs:
         run: make coverage
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8
         with:
           # required so the PR triggers workflow runs
           token: ${{ secrets.GH_CQ_BOT }}
diff --git a/.github/workflows/go_mod_tidy_examples.yml b/.github/workflows/go_mod_tidy_examples.yml
@@ -17,17 +17,17 @@ jobs:
       matrix:
         plugin: [simple_plugin]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           token: ${{ secrets.GH_CQ_BOT }}
       - name: Set up Go 1.x
         id: setup-go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
         with:
           go-version-file: go.mod
           cache: false
       - name: Cache Go modules
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/go/pkg/mod
@@ -39,6 +39,6 @@ jobs:
       - name: Run go mod tidy
         working-directory: examples/${{ matrix.plugin }}
         run: go mod tidy
-      - uses: stefanzweifel/git-auto-commit-action@v7
+      - uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7
         with:
             commit_message: "chore: Tidy"
diff --git a/.github/workflows/lint_golang.yml b/.github/workflows/lint_golang.yml
@@ -16,14 +16,14 @@ jobs:
     runs-on: ubicloud-standard-8
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
         id: setup-go
         with:
           go-version-file: go.mod
           cache: false
       - name: Cache Go modules
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/go/pkg/mod
@@ -33,6 +33,6 @@ jobs:
             ${{ runner.os }}-go-${{ steps.setup-go.outputs.go-version }}-
             ${{ runner.os }}-go-
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9
         with:
           version: v2.10.1
diff --git a/.github/workflows/lint_markdown.yml b/.github/workflows/lint_markdown.yml
@@ -15,7 +15,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Git checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - run: |
           venv="$HOME/.local/share/venv"
           python3 -m venv "$venv"
@@ -33,9 +33,9 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Git checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: markdownlint-cli
-        uses: nosborn/github-action-markdown-cli@v3.5.0
+        uses: nosborn/github-action-markdown-cli@508d6cefd8f0cc99eab5d2d4685b1d5f470042c1 # v3.5.0
         with:
           files: .
           config_file: .markdownlint.yaml
diff --git a/.github/workflows/pr_title.yml b/.github/workflows/pr_title.yml
@@ -18,7 +18,7 @@ jobs:
     steps:
       # Please look up the latest version from
       # https://github.com/amannn/action-semantic-pull-request/releases
-      - uses: amannn/action-semantic-pull-request@v6
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4
         id: release
         with:
           token: ${{ secrets.GH_CQ_BOT }}
@@ -31,7 +31,7 @@ jobs:
         with:
           prerelease: true
       - name: Trigger Renovate
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         if: steps.release.outputs.release_created && steps.semver_parser.outputs.prerelease == ''
         with:
           github-token: ${{ secrets.GH_CQ_BOT }}
diff --git a/.github/workflows/unittest-post.yml b/.github/workflows/unittest-post.yml
@@ -16,9 +16,9 @@ jobs:
     timeout-minutes: 10
     steps:
       # This posts the status to the PR/commit
-      - uses: haya14busa/action-workflow_run-status@v1
+      - uses: haya14busa/action-workflow_run-status@967ed83efa565c257675ed70cfe5231f062ddd94 # v1
       - name: Download benchmarks
-        uses: dawidd6/action-download-artifact@v15
+        uses: dawidd6/action-download-artifact@fe9d59ce33ce92db8a6ac90b2c8be6b6d90417c8 # v15
         with:
           # This is the workflow that triggered this run
           workflow: ${{ github.event.workflow.id }}
@@ -30,7 +30,7 @@ jobs:
         id: pr_number
         run: echo "pr_number=$(cat pr_number)" >> $GITHUB_OUTPUT
       - name: Post deltas to GitHub
-        uses: netlify/delta-action@v4
+        uses: netlify/delta-action@1195810c67610e177b2f60da3f4cf6f620bd5d54 # v4
         with:
           title: "⏱️ Benchmark results"
           style: "text"
diff --git a/.github/workflows/unittest.yml b/.github/workflows/unittest.yml
@@ -19,10 +19,10 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Set up Go 1.x
         id: setup-go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
         with:
           go-version-file: go.mod
           cache: false
@@ -33,7 +33,7 @@ jobs:
           echo "gocache=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
           echo "gomodcache=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
       - name: Cache Go modules
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ${{ steps.go-cache.outputs.gomodcache }}
@@ -54,7 +54,7 @@ jobs:
         run: echo ${{ github.event.number }} > ./pr_number
       - name: Upload deltas
         if: matrix.os == 'ubicloud-standard-8'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: delta-action-benchmarks
           retention-days: 7
