Pinned deps to resolve security vuln

Open-CMSIS-Pack · Oct 29, 2024 · fcc530a · fcc530a
1 parent aedb9b2
commit fcc530a
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 3 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -10,14 +10,17 @@ on:
     tags:
       - "v*"
 
+permissions:
+  contents: read
+
 jobs:
   test:
     uses: Open-CMSIS-Pack/cbuild2cmake/.github/workflows/test.yml@main
 
   goreleaser:
     needs: test
     permissions:
-      contents: write
+      contents: write # for goreleaser/goreleaser-action to create a GitHub release
     runs-on: ubuntu-latest
     steps:
       - name: Download test results

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -86,7 +86,7 @@ jobs:
           check-latest: true
 
       - name: Install go-junit-report
-        run: go install github.com/jstemmer/go-junit-report/v2@latest
+        run: go install github.com/jstemmer/go-junit-report/v2@14d61e6e75e3f3c74551d757ad936e8e88014464 # v2.1.0
 
       - name: Unit testing
         run: |

diff --git a/.github/workflows/tpip-check.yml b/.github/workflows/tpip-check.yml
@@ -40,7 +40,7 @@ jobs:
         run:  go mod tidy
 
       - name: Install go-licenses
-        run:  go install github.com/google/go-licenses@latest
+        run:  go install github.com/google/go-licenses@5348b744d0983d85713295ea08a20cca1654a45e # v1.6.0
 
       - name: Generate TPIP Report
         run:  |