From cdde5155329d03015845a8aec338cc6a915a3f7f Mon Sep 17 00:00:00 2001
From: Markus Pesch <markus.pesch@cryptic.systems>
Date: Wed, 2 Sep 2026 20:40:19 +0200
Subject: [PATCH] chore(ci): bump pinned actions to their latest release

The pinned action versions had drifted apart between the container image repositories, which made it hard to tell
whether a workflow failure was caused by a local change or by an outdated action.

All actions are now pinned to the commit sha of their latest upstream release, so every repository runs the same
toolchain.
---
 .gitea/workflows/auto-release.yaml                  | 2 +-
 .gitea/workflows/build.yaml                         | 6 ++++--
 .gitea/workflows/markdown-linters.yaml              | 4 ++--
 .gitea/workflows/release.yaml                       | 6 ++++--
 .gitea/workflows/update-docker-hub-description.yaml | 2 +-
 5 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/.gitea/workflows/auto-release.yaml b/.gitea/workflows/auto-release.yaml
index f52d932..f8b91f1 100644
--- a/.gitea/workflows/auto-release.yaml
+++ b/.gitea/workflows/auto-release.yaml
@@ -18,7 +18,7 @@ jobs:
 
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index aecd51b..90db3fd 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -15,7 +15,7 @@ jobs:
   build-arm64:
     runs-on: ubuntu-latest-arm64
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
@@ -26,6 +26,7 @@ jobs:
       - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
         with:
           image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
+
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build image
@@ -42,7 +43,7 @@ jobs:
   build-amd64:
     runs-on: ubuntu-latest-amd64
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
@@ -53,6 +54,7 @@ jobs:
       - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
         with:
           image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
+
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build image
diff --git a/.gitea/workflows/markdown-linters.yaml b/.gitea/workflows/markdown-linters.yaml
index 1e62196..2a68476 100644
--- a/.gitea/workflows/markdown-linters.yaml
+++ b/.gitea/workflows/markdown-linters.yaml
@@ -16,7 +16,7 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-    - uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd # v23.2.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
       with:
         globs: '**/*.md'
diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml
index 3ee032e..41de787 100644
--- a/.gitea/workflows/release.yaml
+++ b/.gitea/workflows/release.yaml
@@ -27,7 +27,7 @@ jobs:
           echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
           echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
 
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-tags: true
           ref: "${{ steps.version_extraction.outputs.version_raw }}"
@@ -47,6 +47,7 @@ jobs:
       - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
         with:
           image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
+
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build and push image
@@ -75,7 +76,7 @@ jobs:
           echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
           echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
 
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-tags: true
           ref: "${{ steps.version_extraction.outputs.version_raw }}"
@@ -95,6 +96,7 @@ jobs:
       - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
         with:
           image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
+
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build and push image
diff --git a/.gitea/workflows/update-docker-hub-description.yaml b/.gitea/workflows/update-docker-hub-description.yaml
index b8a2954..9ec0ecc 100644
--- a/.gitea/workflows/update-docker-hub-description.yaml
+++ b/.gitea/workflows/update-docker-hub-description.yaml
@@ -13,7 +13,7 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
       with:
         username: ${{ secrets.DOCKER_IO_USERNAME }}