From 3a18e7a826a2d6cb6b5354df8b6e502fa9c48cd8 Mon Sep 17 00:00:00 2001
From: OpenClaw <openclaw@dataviking.tech>
Date: Sun, 7 Jun 2026 22:11:24 -0500
Subject: [PATCH] ci: SHA-pin third-party GitHub Actions

Pin third-party actions to immutable commit SHAs (version in trailing
comment) to close the mutable-tag supply-chain vector exploited by the
tj-actions and May 2026 Mini-Shai-Hulud cache-poison campaigns.
GitHub-maintained actions/* and github/* left on tags (out of scope).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/docker.yml  | 8 ++++----
 .github/workflows/publish.yml | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 5a97dc93..ef4091c8 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -83,13 +83,13 @@ jobs:
           persist-credentials: false
 
       - name: Set up QEMU (multi-arch emulation)
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -136,7 +136,7 @@ jobs:
 
       - name: Build and push image
         id: build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
         with:
           context: .
           file: ./Dockerfile
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 1a065894..f29426c4 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -63,7 +63,7 @@ jobs:
       # Trusted Publishing — no API token needed; PyPI verifies the GitHub
       # workflow's OIDC identity. skip-existing: true makes retries idempotent.
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
         with:
           skip-existing: true