From b4dd0415cec3772b3eb7b114b4a731f70e559cb5 Mon Sep 17 00:00:00 2001
From: Andrei Gherzan <andrei@gherzan.com>
Date: Sun, 18 Oct 2026 19:36:58 +0100
Subject: [PATCH] ci: pin third-party actions to commit SHAs

Bump actions/checkout from v3 to v7.0.1, as v3 runs on the deprecated node16
runtime. Bump fsfe/reuse-action from v1 to v6.0.0.

Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
---
 .github/workflows/compliance.yml   | 6 +++---
 .github/workflows/yocto-builds.yml | 2 +-
 .github/workflows/yocto-layer.yml  | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/compliance.yml b/.github/workflows/compliance.yml
index 1207acb..cc66fa0 100644
--- a/.github/workflows/compliance.yml
+++ b/.github/workflows/compliance.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Build a temporary DCO image
@@ -41,9 +41,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Do reuse check
         continue-on-error: true
-        uses: fsfe/reuse-action@v1
+        uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0
diff --git a/.github/workflows/yocto-builds.yml b/.github/workflows/yocto-builds.yml
index 43e60e3..ac40ad6 100644
--- a/.github/workflows/yocto-builds.yml
+++ b/.github/workflows/yocto-builds.yml
@@ -32,7 +32,7 @@ jobs:
       SSTATE_DIR: /var/lib/ci/yocto/sstate
     steps:
       - name: Checkout the code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Check for Yocto relevant changes
diff --git a/.github/workflows/yocto-layer.yml b/.github/workflows/yocto-layer.yml
index 109548f..d7805fe 100644
--- a/.github/workflows/yocto-layer.yml
+++ b/.github/workflows/yocto-layer.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: [self-hosted, Linux]
     steps:
       - name: Checkout the code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Check for Yocto relevant changes