09d73cf413
Pin third-party GitHub Actions to immutable SHA digests to prevent supply chain attacks via tag force-pushing or branch updates. Actions pinned: - trufflesecurity/trufflehog (was @main, now SHA) - sigstore/cosign-installer@v3.8.1 - docker/setup-buildx-action@v3.12.0 - docker/setup-qemu-action@v3.7.0 - docker/login-action@v3.7.0 - goreleaser/goreleaser-action@v6.4.0 - aquasecurity/trivy-action@0.33.1 - github/codeql-action/upload-sarif@v4.32.1 - golangci/golangci-lint-action@v9.2.0 - docker/setup-compose-action@v1.2.0 Version comments added for maintainability.