From 31274f5bcc766539a5ca28335547c14ba880b4b8 Mon Sep 17 00:00:00 2001
From: Steven Silvester <steve.silvester@mongodb.com>
Date: Tue, 29 Apr 2025 09:21:02 -0500
Subject: [PATCH] INTPYTHON-608 Use pinned sources for GitHub Actions

---
 .github/workflows/benchmark.yml      | 2 +-
 .github/workflows/dist-python.yml    | 2 +-
 .github/workflows/release-python.yml | 4 ++--
 .github/workflows/test-python.yml    | 2 +-
 .github/workflows/zizmor.yml         | 4 ++--
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index bdbef320..b0d1c165 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -31,7 +31,7 @@ jobs:
           cache: 'pip'
           cache-dependency-path: '**/setup.cfg'
       - name: Start MongoDB
-        uses: supercharge/mongodb-github-action@1.12.0
+        uses: supercharge/mongodb-github-action@90004df786821b6308fb02299e5835d0dae05d0d # 1.12.0
         with:
           mongodb-version: 6.0
       - name: Install deps
diff --git a/.github/workflows/dist-python.yml b/.github/workflows/dist-python.yml
index 074a1fb4..8a346bce 100644
--- a/.github/workflows/dist-python.yml
+++ b/.github/workflows/dist-python.yml
@@ -65,7 +65,7 @@ jobs:
 
       - name: Set up QEMU
         if: matrix.buildplat[1] == 'manylinux_aarch64'
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
         with:
           # setup-qemu-action by default uses `tonistiigi/binfmt:latest` image,
           # which is out of date. This causes seg faults during build.
diff --git a/.github/workflows/release-python.yml b/.github/workflows/release-python.yml
index 34bcd9c6..855a0432 100644
--- a/.github/workflows/release-python.yml
+++ b/.github/workflows/release-python.yml
@@ -88,14 +88,14 @@ jobs:
         name: all-dist-${{ github.run_id }}
         path: dist/
     - name: Publish package distributions to TestPyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1
       with:
         repository-url: https://test.pypi.org/legacy/
         skip-existing: true
         attestations: ${{ env.DRY_RUN }}
     - name: Publish distribution 📦 to PyPI
       if: startsWith(env.DRY_RUN, 'false')
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1
 
   post-publish:
     needs: [publish]
diff --git a/.github/workflows/test-python.yml b/.github/workflows/test-python.yml
index 1dab4e2a..a7361c67 100644
--- a/.github/workflows/test-python.yml
+++ b/.github/workflows/test-python.yml
@@ -56,7 +56,7 @@ jobs:
            echo "LD_LIBRARY_PATH=$PWD/libbson/lib" >> $GITHUB_ENV
       - name: Start MongoDB on Linux
         if: ${{ startsWith(runner.os, 'Linux') }}
-        uses: supercharge/mongodb-github-action@1.12.0
+        uses: supercharge/mongodb-github-action@90004df786821b6308fb02299e5835d0dae05d0d # 1.12.0
         with:
           mongodb-version: 4.4
           mongodb-replica-set: test-rs
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 0fbdbd6d..5b55068c 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -18,7 +18,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Rust
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@9d7e65c320fdb52dcd45ffaa68deb6c02c8754d9 # v1
       - name: Get zizmor
         run: cargo install zizmor
       - name: Run zizmor
@@ -26,7 +26,7 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@28deaeda66b76a05916b6923827895f2b14ab387 # v3
         with:
           sarif_file: results.sarif
           category: zizmor