From 78da99d0aab5c1108f506c7b8b2c3a14e2a47a4c Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Tue, 27 Oct 2026 10:52:19 +0000 Subject: [PATCH] Correct pinned Docker login action version annotations The v4 tag advanced to v4.7.0 while our SHA still resolves to v4.6.0. Online Zizmor therefore stops CI before tests and publication. Record the exact pinned release without changing executable workflow content or loosening the audit. --- .github/actions/quay/action.yml | 2 +- .github/workflows/ci.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/actions/quay/action.yml b/.github/actions/quay/action.yml index 44f7d9cc..3c99a42c 100644 --- a/.github/actions/quay/action.yml +++ b/.github/actions/quay/action.yml @@ -17,7 +17,7 @@ runs: using: 'composite' steps: - name: Log in to the Container registry - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: quay.io username: ${{ env.QUAY_USER }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e061e075..08b9e50f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -164,14 +164,14 @@ jobs: go-version-file: go.mod cache: false - name: Log in to the Container registry - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 if: github.event_name != 'pull_request' with: registry: quay.io username: ${{ secrets.QUAY_USER }} password: ${{ secrets.QUAY_PASSWORD }} - name: Log in to the Container registry - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 if: github.event_name != 'pull_request' with: registry: docker.io