From 8a87c335944c32b2cab3ff494259ecb42cf4473b Mon Sep 17 00:00:00 2001 From: Tim Gross Date: Wed, 14 May 2025 14:25:37 -0400 Subject: [PATCH] build: pin actionlint workflow (#25855) We're required to pin Docker images for Actions to a specific SHA now and this is tripping scans in the Enterprise repo. Update the actionlint image. Ref: https://go.hashi.co/memo/sec-032 --- .github/workflows/actionlint.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml index eab623020..7a2d0c26c 100644 --- a/.github/workflows/actionlint.yml +++ b/.github/workflows/actionlint.yml @@ -12,4 +12,4 @@ jobs: steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: "Check workflow files" - uses: docker://docker.mirror.hashicorp.services/rhysd/actionlint:latest + uses: docker://docker.mirror.hashicorp.services/rhysd/actionlint@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9