From 955d268dc99e7e4b616bef75f9b27aeff3071b7d Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Wed, 21 Oct 2026 17:04:23 -0400 Subject: [PATCH] ci: pin GitHub Actions to full commit SHA (SonarCloud githubactions:S7637) Pin third-party actions to full-length commit SHAs (with version comments) instead of mutable tags/branches to prevent supply-chain tampering via retagged releases. Resolves SonarCloud rule githubactions:S7637. --- .github/workflows/printing.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/printing.yml b/.github/workflows/printing.yml index 722cd5dc8..99aef710d 100644 --- a/.github/workflows/printing.yml +++ b/.github/workflows/printing.yml @@ -50,7 +50,7 @@ jobs: pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcursor-dev libxrandr-dev \ libxi-dev libgtk-3-dev libfontconfig1-dev libfreetype-dev libvulkan1 mesa-vulkan-drivers - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable with: components: rustfmt, clippy targets: wasm32-unknown-unknown