From 4eff8bbc6de4c7c365dd82b1c0735e320b0190db Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Mon, 6 Jul 2026 18:26:29 -0400
Subject: [PATCH] chore(ci): SHA-pin mutable-tag third-party actions
 (INFRA-118) (#72)

---
 .github/workflows/cd-cdk.yaml            | 4 ++--
 .github/workflows/cd-mobile-ios.yaml     | 2 +-
 .github/workflows/cd-sam.yaml            | 4 ++--
 .github/workflows/ci-python-sam.yaml     | 4 ++--
 .github/workflows/ci-typescript-cdk.yaml | 4 ++--
 5 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/cd-cdk.yaml b/.github/workflows/cd-cdk.yaml
index 385ea5c..055c6c3 100644
--- a/.github/workflows/cd-cdk.yaml
+++ b/.github/workflows/cd-cdk.yaml
@@ -55,7 +55,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
         if: ${{ inputs.enable-qemu }}
 
       - uses: actions/setup-dotnet@v5
@@ -90,7 +90,7 @@ jobs:
             pip install -r "$req"
           done
 
-      - uses: aws-actions/configure-aws-credentials@v6
+      - uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
diff --git a/.github/workflows/cd-mobile-ios.yaml b/.github/workflows/cd-mobile-ios.yaml
index d65950f..488e77d 100644
--- a/.github/workflows/cd-mobile-ios.yaml
+++ b/.github/workflows/cd-mobile-ios.yaml
@@ -62,7 +62,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: aws-actions/configure-aws-credentials@v6
+      - uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
diff --git a/.github/workflows/cd-sam.yaml b/.github/workflows/cd-sam.yaml
index 24fde89..d176ea4 100644
--- a/.github/workflows/cd-sam.yaml
+++ b/.github/workflows/cd-sam.yaml
@@ -46,9 +46,9 @@ jobs:
         with:
           python-version: ${{ inputs.python-version }}
 
-      - uses: aws-actions/setup-sam@v3
+      - uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3
 
-      - uses: aws-actions/configure-aws-credentials@v6
+      - uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
diff --git a/.github/workflows/ci-python-sam.yaml b/.github/workflows/ci-python-sam.yaml
index 4bd0cca..a434a97 100644
--- a/.github/workflows/ci-python-sam.yaml
+++ b/.github/workflows/ci-python-sam.yaml
@@ -89,7 +89,7 @@ jobs:
 
       - name: Set up QEMU
         if: ${{ inputs.run-cdk-synth && inputs.enable-qemu }}
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
 
       - name: CDK synth
         if: ${{ inputs.run-cdk-synth }}
@@ -147,7 +147,7 @@ jobs:
 
       - name: Setup SAM CLI
         if: ${{ inputs.run-sam-validate }}
-        uses: aws-actions/setup-sam@v3
+        uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3
 
       - name: SAM validate
         if: ${{ inputs.run-sam-validate }}
diff --git a/.github/workflows/ci-typescript-cdk.yaml b/.github/workflows/ci-typescript-cdk.yaml
index 9fcb13d..2808ee5 100644
--- a/.github/workflows/ci-typescript-cdk.yaml
+++ b/.github/workflows/ci-typescript-cdk.yaml
@@ -66,7 +66,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
         if: ${{ inputs.enable-qemu }}
 
       - uses: actions/setup-dotnet@v5
@@ -156,7 +156,7 @@ jobs:
 
       - name: Setup SAM CLI
         if: ${{ inputs.run-sam-validate }}
-        uses: aws-actions/setup-sam@v3
+        uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3
 
       - name: SAM validate
         if: ${{ inputs.run-sam-validate }}