From 7deed050b0ea79577ba8c9719ed0cc25335b7225 Mon Sep 17 00:00:00 2001
From: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
Date: Tue, 8 Sep 2026 16:33:09 -0600
Subject: [PATCH] Pin GitHub Actions to immutable SHAs

Mutable version tags let an action's behavior change without any
change on our side. Pin each action used here to its current
release's commit SHA, keeping the version as a trailing comment for
readability.

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
---
 .github/workflows/codeql.yml              | 6 +++---
 .github/workflows/deploy-docs.yml         | 8 ++++----
 .github/workflows/merge-dependabot-pr.yml | 4 ++--
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f3c1fd2aaa..e27e59bd80 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -53,7 +53,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Add any setup steps before running the `github/codeql-action/init` action.
       # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -63,7 +63,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.9
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -75,6 +75,6 @@ jobs:
           queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.9
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index 5c98681d9b..b1a819951e 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -17,11 +17,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 5
     - name: Set Up Gradle
-      uses: spring-io/spring-gradle-build-action@v2
+      uses: spring-io/spring-gradle-build-action@c8668747d7c264864c8c7f7026d0d277d14a78dc # v2.0.6
       with:
         # Use JDK 17 since 6.5.x Kotlin version does not support JDK 25 and thus will fail
         java-version: '17'
@@ -37,14 +37,14 @@ jobs:
     - name: Copy the cache to be included in the site
       run: cp -rf build/antora/inject-collector-cache-config-extension/.cache build/site/
     - name: Publish Docs
-      uses: spring-io/spring-doc-actions/rsync-antora-reference@v0.0.22
+      uses: spring-io/spring-doc-actions/rsync-antora-reference@415e2b11a766ba64799fffb5c97a4f7e17f677cf # v0.0.22
       with:
         docs-username: ${{ secrets.DOCS_USERNAME }}
         docs-host: ${{ secrets.DOCS_HOST }}
         docs-ssh-key: ${{ secrets.DOCS_SSH_KEY }}
         docs-ssh-host-key: ${{ secrets.DOCS_SSH_HOST_KEY }}
     - name: Bust Clouflare Cache
-      uses: spring-io/spring-doc-actions/bust-cloudflare-antora-cache@v0.0.22
+      uses: spring-io/spring-doc-actions/bust-cloudflare-antora-cache@415e2b11a766ba64799fffb5c97a4f7e17f677cf # v0.0.22
       with:
         context-root: spring-security
         cloudflare-zone-id: ${{ secrets.CLOUDFLARE_ZONE_ID }}
diff --git a/.github/workflows/merge-dependabot-pr.yml b/.github/workflows/merge-dependabot-pr.yml
index 06cc00364a..efd5cdce02 100644
--- a/.github/workflows/merge-dependabot-pr.yml
+++ b/.github/workflows/merge-dependabot-pr.yml
@@ -14,12 +14,12 @@ jobs:
     if: github.event.pull_request.user.login == 'dependabot[bot]'
     steps:
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           show-progress: false
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - uses: actions/setup-java@v6
+      - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: temurin
           java-version: 17