From ec9627d365ffd217b02d71683ea52eb8cc814638 Mon Sep 17 00:00:00 2001
From: "security-dnanexus-standards[bot]"
 <3325613+security-dnanexus-standards[bot]@users.noreply.github.com>
Date: Sat, 20 Jun 2026 16:53:25 +0000
Subject: [PATCH 1/3] pin `actions/checkout` actions to SHA version

---
 .github/workflows/build-packages.yml | 6 +++---
 .github/workflows/build-tests.yml    | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/build-packages.yml b/.github/workflows/build-packages.yml
index 8cdec65..4906d7f 100644
--- a/.github/workflows/build-packages.yml
+++ b/.github/workflows/build-packages.yml
@@ -18,7 +18,7 @@ jobs:
       GOARCH: amd64
       CGO_ENABLED: 1
     steps:
-        - uses: actions/checkout@v4.2.2
+        - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         - uses: actions/setup-go@v5
           with:
             go-version: '1.22.12'
@@ -49,7 +49,7 @@ jobs:
       GOARCH: amd64
       CGO_ENABLED: 1
     steps:
-        - uses: actions/checkout@v4.2.2
+        - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         - uses: actions/setup-go@v5
           with:
             go-version: '1.22.12'
@@ -77,7 +77,7 @@ jobs:
     name: Linux build
     runs-on: ubuntu-latest
     steps:
-        - uses: actions/checkout@v4.2.2
+        - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         - name: Build builder Docker image
           uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75
           with:
diff --git a/.github/workflows/build-tests.yml b/.github/workflows/build-tests.yml
index 0bd15ab..d30a392 100644
--- a/.github/workflows/build-tests.yml
+++ b/.github/workflows/build-tests.yml
@@ -14,7 +14,7 @@ jobs:
       GOARCH: amd64
       CGO_ENABLED: 1
     steps:
-        - uses: actions/checkout@v4.2.2
+        - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         - uses: actions/setup-go@v5
           with:
             go-version: '1.22.12'
@@ -32,7 +32,7 @@ jobs:
       GOARCH: amd64
       CGO_ENABLED: 1
     steps:
-        - uses: actions/checkout@v4.2.2
+        - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         - uses: actions/setup-go@v5
           with:
             go-version: '1.22.12'
@@ -44,7 +44,7 @@ jobs:
     name: Linux build and test
     runs-on: ubuntu-latest
     steps:
-        - uses: actions/checkout@v4.2.2
+        - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         - name: Build builder Docker image
           uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75
           with:

From 9ea5b129f7b8b719006163c611dbc66a36e01b55 Mon Sep 17 00:00:00 2001
From: "security-dnanexus-standards[bot]"
 <3325613+security-dnanexus-standards[bot]@users.noreply.github.com>
Date: Sat, 20 Jun 2026 16:53:25 +0000
Subject: [PATCH 2/3] pin `actions/setup-go` actions to SHA version

---
 .github/workflows/build-packages.yml | 4 ++--
 .github/workflows/build-tests.yml    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build-packages.yml b/.github/workflows/build-packages.yml
index 4906d7f..35f2653 100644
--- a/.github/workflows/build-packages.yml
+++ b/.github/workflows/build-packages.yml
@@ -19,7 +19,7 @@ jobs:
       CGO_ENABLED: 1
     steps:
         - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        - uses: actions/setup-go@v5
+        - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
           with:
             go-version: '1.22.12'
         - name: Build Macos executable
@@ -50,7 +50,7 @@ jobs:
       CGO_ENABLED: 1
     steps:
         - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        - uses: actions/setup-go@v5
+        - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
           with:
             go-version: '1.22.12'
         - name: go dependencies
diff --git a/.github/workflows/build-tests.yml b/.github/workflows/build-tests.yml
index d30a392..37c8795 100644
--- a/.github/workflows/build-tests.yml
+++ b/.github/workflows/build-tests.yml
@@ -15,7 +15,7 @@ jobs:
       CGO_ENABLED: 1
     steps:
         - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        - uses: actions/setup-go@v5
+        - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
           with:
             go-version: '1.22.12'
         - name: Build Macos executable
@@ -33,7 +33,7 @@ jobs:
       CGO_ENABLED: 1
     steps:
         - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        - uses: actions/setup-go@v5
+        - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
           with:
             go-version: '1.22.12'
         - name: Build Windows executable

From a6d943bfab7b99505c5a8c0c251ae82e4baea8bc Mon Sep 17 00:00:00 2001
From: "security-dnanexus-standards[bot]"
 <3325613+security-dnanexus-standards[bot]@users.noreply.github.com>
Date: Sat, 20 Jun 2026 16:53:25 +0000
Subject: [PATCH 3/3] pin `docker/metadata-action` actions to SHA version

---
 .github/workflows/build-packages.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-packages.yml b/.github/workflows/build-packages.yml
index 35f2653..a826fdd 100644
--- a/.github/workflows/build-packages.yml
+++ b/.github/workflows/build-packages.yml
@@ -118,7 +118,7 @@ jobs:
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v4 # v4
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 # v4
         with:
           images: |
             dnanexus/dxda