ci: pin cachix actions to exact tags
zizmor flagged the install-nix-action and cachix-action pins as having mismatched version comments: the SHAs pointed to intermediate commits, not tags.
Jörg Thalheim committed
May 17, 2026 at 08:37 UTC
b59a60b9a5e761ef511e334292b2d12706327918
1 file changed
+12
-12
.github/workflows/ci.yml
+12
-12
@@ -24,7 +24,7 @@ jobs:
24
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
25
with:
26
persist-credentials: false
27
- - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31
27
+ - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
28
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
29
with:
30
name: nixos-infra-dev
@@ -50,7 +50,7 @@ jobs:
50
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
51
with:
52
persist-credentials: false
53
- - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31
53
+ - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
54
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
55
with:
56
name: nixos-infra-dev
@@ -69,7 +69,7 @@ jobs:
69
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
70
with:
71
persist-credentials: false
72
- - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31
72
+ - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
73
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
74
with:
75
name: nixos-infra-dev
@@ -84,8 +84,8 @@ jobs:
84
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
85
with:
86
persist-credentials: false
87
- - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31
88
- - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
87
+ - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
88
+ - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
89
with:
90
name: nixos-infra-dev
91
authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
@@ -97,8 +97,8 @@ jobs:
97
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
98
with:
99
persist-credentials: false
100
- - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31
101
- - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
100
+ - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
101
+ - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
102
with:
103
name: nixos-infra-dev
104
authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
@@ -110,8 +110,8 @@ jobs:
110
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
111
with:
112
persist-credentials: false
113
- - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31
114
- - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
113
+ - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
114
+ - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
115
with:
116
name: nixos-infra-dev
117
authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
@@ -123,8 +123,8 @@ jobs:
123
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
124
with:
125
persist-credentials: false
126
- - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31
127
- - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
126
+ - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
127
+ - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
128
with:
129
name: nixos-infra-dev
130
authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
@@ -141,7 +141,7 @@ jobs:
141
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
142
with:
143
persist-credentials: false
144
- - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31
144
+ - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
145
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
146
with:
147
name: nixos-infra-dev