Isaac ConnorandClaude Opus 5.5 ad5dbaf974 ci: pin every workflow action to a commit SHA refs GHSA-rh6j-hgq6-hpmh ...

The package workflows' publish steps ran easingthemes/ssh-deploy@main with
the zmrepo SSH key in its environment, and imported the package signing key
with crazy-max/ghaction-import-gpg@v7. A branch or tag is resolved when the
workflow runs, so whoever could move it upstream could run code with those
keys on our next push to master or release-1.38, and publish packages to the
apt and rpm repositories.

Pin each `uses:` to the commit its ref names today, with the ref as a comment
so dependabot keeps updating them. ssh-deploy is pinned to v6.0.1, which main
differs from only in release metadata. GitHub's own actions are pinned too.

utils/check-pinned-actions.py and the CI Pinned Actions workflow fail when a
workflow uses an action by anything but a full commit SHA.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-11 22:46:28 -04:00

..

docker

…

packpack

…

bump-version.pl

…

check-homoglyphs.py

…

check-pinned-actions.py

…

check-shareddata-abi.py

…

do_debian_package.sh

…

generate_apache_config.pl

…

mk_bigfont.pl

…

resample_event_video.sh

…

travis.pl

…

zm-alarm.pl

…

zmeditconfigdata.sh

…

zmrepo_mkdirs.sh

…