From 276f0e5c52aafb683fa6d7576e36f6290cab96bf Mon Sep 17 00:00:00 2001
From: Devin Foley <devin@paperclip.ing>
Date: Thu, 10 Sep 2026 18:21:18 -0700
Subject: [PATCH] ci: pin cloud build actions to verified releases

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 .github/workflows/docker-cloud.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/docker-cloud.yml b/.github/workflows/docker-cloud.yml
index 93b720829f..500a9ca078 100644
--- a/.github/workflows/docker-cloud.yml
+++ b/.github/workflows/docker-cloud.yml
@@ -24,7 +24,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           # Full history and tags so `git describe` below can compute the
           # release version to stamp into the image.
@@ -64,7 +64,7 @@ jobs:
         run: echo "epoch=$(date -u +%G-W%V)" >> "$GITHUB_OUTPUT"
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
         with:
           version: 9.15.4
           run_install: false
@@ -73,7 +73,7 @@ jobs:
       # restoring a shared Actions cache into the build inputs would let a
       # poisoned cache entry reach the published artifact.
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: 24
 
@@ -120,14 +120,14 @@ jobs:
           df -h
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
 
       # Deployment tooling reads these labels from the registry to verify an
       # image's schema expectations against a migrator before deploying it,
@@ -149,7 +149,7 @@ jobs:
       # ownership rule as `:canary` above.
       - name: Docker meta (cloud)
         id: meta-cloud
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
         with:
           images: ghcr.io/${{ github.repository }}
           flavor: |
@@ -167,7 +167,7 @@ jobs:
 
       - name: Build and push (cloud)
         id: build-cloud
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: .
           target: cloud