From 9e4e67f5770602d0976eed0b19d798991245b6f0 Mon Sep 17 00:00:00 2001
From: Ryan Foster <ryan@obsproject.com>
Date: Mon, 30 Mar 2026 18:11:01 -0400
Subject: [PATCH] CI: Pin actions/download-artifact to commit hash

The v4 tag currently points to v4.3.0 which is
https://github.com/actions/download-artifact/commit/d3f86a106a0bac45b974a628896c90dbdf5c8093.

https://github.com/actions/download-artifact/releases/tag/v4.3.0
---
 .github/actions/steam-upload/action.yaml | 2 +-
 .github/workflows/dispatch.yaml          | 2 +-
 .github/workflows/push.yaml              | 6 +++---
 .github/workflows/sign-windows.yaml      | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/actions/steam-upload/action.yaml b/.github/actions/steam-upload/action.yaml
index 1b7aefad2..f056e725e 100644
--- a/.github/actions/steam-upload/action.yaml
+++ b/.github/actions/steam-upload/action.yaml
@@ -70,7 +70,7 @@ runs:
 
     - name: Download Nightly Assets 🌙
       id: asset-info-nightly
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
       if: github.event_name == 'schedule'
 
     - name: Download Assets 📥
diff --git a/.github/workflows/dispatch.yaml b/.github/workflows/dispatch.yaml
index 958a9fefa..622ab3784 100644
--- a/.github/workflows/dispatch.yaml
+++ b/.github/workflows/dispatch.yaml
@@ -123,7 +123,7 @@ jobs:
           : Get Commit Hash 🆔
           echo "commitHash=${GITHUB_SHA:0:9}" >> $GITHUB_OUTPUT
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: OBS Studio Docs (No Extensions) ${{ steps.setup.outputs.commitHash }}
           path: docs
diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
index 456140ef9..edf0cf187 100644
--- a/.github/workflows/push.yaml
+++ b/.github/workflows/push.yaml
@@ -115,7 +115,7 @@ jobs:
           : Get Commit Hash 🆔
           echo "commitHash=${GITHUB_SHA:0:9}" >> $GITHUB_OUTPUT
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: OBS Studio Docs (No Extensions) ${{ steps.setup.outputs.commitHash }}
           path: docs
@@ -172,7 +172,7 @@ jobs:
           print "channel=${channel}" >> $GITHUB_OUTPUT
 
       - name: Download Artifact 📥
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: obs-studio-macos-${{ matrix.target }}-${{ steps.setup.outputs.commitHash }}
 
@@ -247,7 +247,7 @@ jobs:
           esac
 
       - name: Download Build Artifacts 📥
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         if: ${{ fromJSON(steps.check.outputs.validTag) }}
 
       - name: Rename Files 🏷️
diff --git a/.github/workflows/sign-windows.yaml b/.github/workflows/sign-windows.yaml
index 2f410f3fd..8de914f1d 100644
--- a/.github/workflows/sign-windows.yaml
+++ b/.github/workflows/sign-windows.yaml
@@ -42,7 +42,7 @@ jobs:
           "commitHash=${shortHash}" >> $env:GITHUB_OUTPUT
 
       - name: Download Artifact 📥
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: obs-studio-windows-${{ matrix.architecture }}-${{ steps.setup.outputs.commitHash }}
           path: ${{ github.workspace }}/build