Ref actions by commit SHA in test.yml

It's important to make sure the SHA's are from the original repositories and not forks. For reference: https://github.com/actions/setup-go/releases/tag/v4.0.1 actions/setup-go@fac708d https://github.com/actions/checkout/releases/tag/v3.5.2 actions/checkout@8e5e7e5 https://github.com/actions/cache/releases/tag/v3.3.1 actions/cache@88522ab Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
shirou · Jun 7, 2023 · 147902f · 147902f
1 parent 4043011
commit 147902f
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -23,17 +23,17 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Install Go
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
       with:
         go-version: ${{ matrix.go-version }}
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
     - id: go-env
       run: |
         echo "::set-output name=cache::$(go env GOCACHE)"
         echo "::set-output name=mod-cache::$(go env GOMODCACHE)"
     - name: Cache go modules
-      uses: actions/cache@v3
+      uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
       with:
         path: |
           ${{ steps.go-env.outputs.cache }}