From e60f2e137cc372c14e8ab54453c97d01be43be6b Mon Sep 17 00:00:00 2001 From: Louis Lotter Date: Tue, 27 Oct 2026 11:51:48 +0100 Subject: [PATCH] Match Docker login action comments to pinned release The floating v4 tag moved after main passed CI, making the v3.9.4 tag audit fail. Label the unchanged commit as v4.6.0 so online Zizmor audits use the exact release. --- .github/actions/quay/action.yml | 2 +- .github/workflows/ci.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/actions/quay/action.yml b/.github/actions/quay/action.yml index 44f7d9cc..3c99a42c 100644 --- a/.github/actions/quay/action.yml +++ b/.github/actions/quay/action.yml @@ -17,7 +17,7 @@ runs: using: 'composite' steps: - name: Log in to the Container registry - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: quay.io username: ${{ env.QUAY_USER }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e061e075..08b9e50f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -164,14 +164,14 @@ jobs: go-version-file: go.mod cache: false - name: Log in to the Container registry - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 if: github.event_name != 'pull_request' with: registry: quay.io username: ${{ secrets.QUAY_USER }} password: ${{ secrets.QUAY_PASSWORD }} - name: Log in to the Container registry - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 if: github.event_name != 'pull_request' with: registry: docker.io