From bdddd24436f1cbc20e3d5fe78dd158c89823830f Mon Sep 17 00:00:00 2001
From: sechmachine <97589681+sechmachine727@users.noreply.github.com>
Date: Thu, 30 Jul 2026 15:18:54 +0700
Subject: [PATCH] ci(gateway): pin candidate actions

---
 .gitea/workflows/verify.yml |  8 ++++----
 gateway/packaging_test.go   | 22 ++++++++++++++++++++++
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/verify.yml b/.gitea/workflows/verify.yml
index f6952c6..3ce7c83 100644
--- a/.gitea/workflows/verify.yml
+++ b/.gitea/workflows/verify.yml
@@ -17,13 +17,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version: "1.26.5"
           cache: true
           cache-dependency-path: go.mod
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: "1.3.13"
       - name: Verify Go and OpenSpec baseline
@@ -35,7 +35,7 @@ jobs:
           file dist/verse-gateway-linux-* | tee dist/file.txt
           go version -m dist/verse-gateway-linux-amd64 > dist/go-version-amd64.txt
           go version -m dist/verse-gateway-linux-arm64 > dist/go-version-arm64.txt
-      - uses: christopherhx/gitea-upload-artifact@v4
+      - uses: christopherhx/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7 # v4
         with:
           name: verse-gateway-linux-${{ gitea.sha }}
           path: dist/*
diff --git a/gateway/packaging_test.go b/gateway/packaging_test.go
index 896ff75..88fe69f 100644
--- a/gateway/packaging_test.go
+++ b/gateway/packaging_test.go
@@ -1,15 +1,37 @@
 package gateway
 
 import (
+	"bufio"
 	"bytes"
 	"debug/buildinfo"
 	"debug/elf"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
+	"strings"
 	"testing"
 )
 
+func TestCIActionReferencesAreImmutable(t *testing.T) {
+	workflow, err := os.Open(filepath.Join("..", ".gitea", "workflows", "verify.yml"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer workflow.Close()
+	immutable := regexp.MustCompile(`@[0-9a-f]{40}(?:\s+#.*)?$`)
+	scanner := bufio.NewScanner(workflow)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if strings.HasPrefix(line, "- uses:") && !immutable.MatchString(line) {
+			t.Errorf("mutable CI action reference: %s", line)
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestGatewayLinuxArtifactsAreReproduciblePureGoELF(t *testing.T) {
 	first, second := t.TempDir(), t.TempDir()
 	for _, output := range []string{first, second} {