From 296a6e679cdc8dd39419f47875382132d9ed06a6 Mon Sep 17 00:00:00 2001
From: 54m <30588003+54m@users.noreply.github.com>
Date: Sun, 3 May 2026 01:15:54 +0900
Subject: [PATCH] chore(ci): pin all GitHub Actions to full-length commit SHAs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Following GitHub's hardening guide, pin every third-party (and
first-party) action used in workflows to a full 40-char commit SHA,
with a version comment for human readability. This protects against
supply-chain attacks where a tag could be silently re-pointed to a
malicious commit.

Pinned actions:
- actions/checkout (v4.3.1)
- actions/setup-go (v5.6.0)
- actions/cache (v4.3.0)
- actions/setup-node (v4.4.0)
- dart-lang/setup-dart (v1.7.2)
- nanasess/setup-chromedriver (v2.2.2)
- golangci/golangci-lint-action (v7.0.1)
- goreleaser/goreleaser-action (v5.0.0)

対象ファイル:
- .github/workflows/go.yml
- .github/workflows/linter.yml
- .github/workflows/release.yml
---
 .github/workflows/go.yml      | 20 ++++++++++----------
 .github/workflows/linter.yml  |  6 +++---
 .github/workflows/release.yml |  6 +++---
 3 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 10ce56a..7a5403b 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -15,14 +15,14 @@ jobs:
 
     steps:
     - name: Set up Go 1.25
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version: '1.25'
       id: go
 
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-    - uses: actions/cache@v4
+    - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: ~/go/pkg/mod
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
@@ -41,20 +41,20 @@ jobs:
 
     steps:
     - name: Set up Go 1.25
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version: '1.25'
       id: go
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: '20'
-    - uses: dart-lang/setup-dart@v1
+    - uses: dart-lang/setup-dart@65eb853c7ba17dde3be364c3d2858773e7144260 # v1.7.2
       with:
         sdk: "2.14.4"
-    - uses: nanasess/setup-chromedriver@v2.2.2
-    - uses: actions/checkout@v4
+    - uses: nanasess/setup-chromedriver@42cc2998329f041de87dc3cfa33a930eacd57eaa # v2.2.2
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-    - uses: actions/cache@v4
+    - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: ~/go/pkg/mod
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
@@ -63,7 +63,7 @@ jobs:
 
     - name: Run E2E tests
       run: |
-        make e2e       
+        make e2e
 
     - name: Ensure samples are generated
       env:
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index 9460189..6822ffa 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -6,8 +6,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: '1.25'
       - name: Install dependencies
@@ -30,7 +30,7 @@ jobs:
             exit 1
           fi
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v7
+        uses: golangci/golangci-lint-action@9fae48acfc02a90574d7c304a1758ef9895495fa # v7.0.1
         with:
           args: "--config=.github/.golangci.yml"
           version: v2.12.1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2cc7a62..58e467b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,17 +10,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 1
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: '1.25'
 
       - name: Run GoReleaser for api_gen
-        uses: goreleaser/goreleaser-action@v5.0.0
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
         with:
           version: latest
           args: release --rm-dist