From 454f0526d6044d5e08d4164fd47946dadfa70e78 Mon Sep 17 00:00:00 2001
From: toim <desinformatsioon@gmail.com>
Date: Mon, 6 Jul 2026 23:48:30 +0300
Subject: [PATCH] pin GitHub Actions to full commit SHAs and rework actions
 shas to own block . Improves https://github.com/labstack/echo/pull/3029

---
 .github/workflows/checks.yml | 16 ++++++++++------
 .github/workflows/echo.yml   | 26 +++++++++++++++++---------
 2 files changed, 27 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index cfe4ca563..528786df3 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -10,21 +10,26 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read #  to fetch code (actions/checkout)
+  contents: read # to fetch code (actions/checkout)
 
 env:
-  # run static analysis only with the latest Go version
   LATEST_GO_VERSION: "1.26"
 
+  # https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10
+  CHECKOUT_ACTION: &checkout_action actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+  # https://github.com/actions/setup-go/commit/924ae3a1cded613372ab5595356fb5720e22ba16
+  SETUP_GO_ACTION: &setup_go_action actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+
 jobs:
   check:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: *checkout_action
 
-      - name: Set up Go ${{ matrix.go }}
-        uses: actions/setup-go@v6
+      - name: Set up Go
+        uses: *setup_go_action
         with:
           go-version: ${{ env.LATEST_GO_VERSION }}
           check-latest: true
@@ -44,4 +49,3 @@ jobs:
           go version
           go install golang.org/x/vuln/cmd/govulncheck@latest
           govulncheck ./...
-
diff --git a/.github/workflows/echo.yml b/.github/workflows/echo.yml
index e11a029fc..f294bf2a9 100644
--- a/.github/workflows/echo.yml
+++ b/.github/workflows/echo.yml
@@ -10,12 +10,20 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read #  to fetch code (actions/checkout)
+  contents: read # to fetch code (actions/checkout)
 
 env:
-  # run coverage and benchmarks only with the latest Go version
   LATEST_GO_VERSION: "1.26"
 
+  # https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10
+  CHECKOUT_ACTION: &checkout_action actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+  # https://github.com/actions/setup-go/commit/924ae3a1cded613372ab5595356fb5720e22ba16
+  SETUP_GO_ACTION: &setup_go_action actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+
+  # https://github.com/codecov/codecov-action/commit/fb8b3582c8e4def4969c97caa2f19720cb33a72f
+  CODECOV_ACTION: &codecov_action codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
+
 jobs:
   test:
     strategy:
@@ -30,10 +38,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: *checkout_action
 
       - name: Set up Go ${{ matrix.go }}
-        uses: actions/setup-go@v6
+        uses: *setup_go_action
         with:
           go-version: ${{ matrix.go }}
 
@@ -42,7 +50,7 @@ jobs:
 
       - name: Upload coverage to Codecov
         if: success() && matrix.go == env.LATEST_GO_VERSION && matrix.os == 'ubuntu-latest'
-        uses: codecov/codecov-action@v6
+        uses: *codecov_action
         with:
           token:
           fail_ci_if_error: false
@@ -53,18 +61,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code (Previous)
-        uses: actions/checkout@v6
+        uses: *checkout_action
         with:
           ref: ${{ github.base_ref }}
           path: previous
 
       - name: Checkout Code (New)
-        uses: actions/checkout@v6
+        uses: *checkout_action
         with:
           path: new
 
-      - name: Set up Go ${{ matrix.go }}
-        uses: actions/setup-go@v6
+      - name: Set up Go
+        uses: *setup_go_action
         with:
           go-version: ${{ env.LATEST_GO_VERSION }}