From a34fa64dc1cc2bd5efd11f0946974c9ff6d75c84 Mon Sep 17 00:00:00 2001
From: Dennis Klein <d.klein@gsi.de>
Date: Wed, 10 Jun 2026 19:22:55 +0200
Subject: [PATCH] ci: pin third-party actions to release commit SHAs

- hendrikmuhs/ccache-action: the v1 major tag also lagged behind the
  latest release (v1.2.20 instead of v1.2.23), so this is a bump too
- threeal/cmake-action: v2 == v2.1.0, pinned as-is
---
 .github/workflows/ci.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3e6f52d9..0617f3ce 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,13 +37,13 @@ jobs:
           env: ${{ matrix.env }}
 
       - name: ccache
-        uses: hendrikmuhs/ccache-action@v1
+        uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
         with:
           key: ${{ github.job }}-${{ matrix.env }}-gcc${{ matrix.gcc }}
           max-size: 500M
 
       - name: Configure and Build
-        uses: threeal/cmake-action@v2
+        uses: threeal/cmake-action@725d1314ccf9ea922805d7e3f9d9bcbca892b406 # v2.1.0
         with:
           generator: Ninja
           options: |
@@ -100,7 +100,7 @@ jobs:
           env: ${{ matrix.sanitizer.env }}
 
       - name: ccache
-        uses: hendrikmuhs/ccache-action@v1
+        uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
         with:
           key: ${{ github.job }}-${{ matrix.sanitizer.name }}
           max-size: 500M
@@ -119,7 +119,7 @@ jobs:
           echo "test_library_path=$prefix/lib" >> $GITHUB_ENV
 
       - name: Configure and Build
-        uses: threeal/cmake-action@v2
+        uses: threeal/cmake-action@725d1314ccf9ea922805d7e3f9d9bcbca892b406 # v2.1.0
         with:
           generator: Ninja
           cxx-flags: ${{ matrix.sanitizer.cxx-flags }}
@@ -180,7 +180,7 @@ jobs:
           gcc: '14'
 
       - name: ccache
-        uses: hendrikmuhs/ccache-action@v1
+        uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
         with:
           key: ${{ github.job }}
           max-size: 500M