From 91a3a2c447a6f6e9d2cacc15fff0469af2726b31 Mon Sep 17 00:00:00 2001
From: Devon Bautista <17506592+synackd@users.noreply.github.com>
Date: Wed, 2 Sep 2026 11:14:46 -0600
Subject: [PATCH] fix(security): use v3.6 hashes for reusable workflows

The Security workflow referenced three reusable workflows (govulncheck,
dependency-review and lint-workflows) at the v3.2 tag of the
OpenCHAMI/github-actions repository. The v3.2 tag does not contain these
files, which caused the workflow parsing step to fail with a "failed to
fetch workflow: workflow was not found" error.

Update the `uses:` lines in .github/workflows/security.yaml to point to
the commit hash represented by the v3.6 tag for all three jobs, ensuring
security compliance with immutable hashes and updating the version to
the proper one containing the expected files.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>
---
 .github/workflows/lint.yaml     | 10 +++++-----
 .github/workflows/security.yaml |  6 +++---
 .github/workflows/test.yaml     | 12 ++++++------
 3 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 4b87d961..e1a46c12 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -24,17 +24,17 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@v6.4.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
 
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v9.2.0
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         with:
           version: v2.13.2
 
@@ -44,12 +44,12 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@v6.4.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
 
diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
index 9964c8eb..216938e1 100644
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -20,7 +20,7 @@ permissions:
 jobs:
   govulncheck:
     name: govulncheck
-    uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@v3.2
+    uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@464e059fbd56372b085ea7956712d41bd6df59d0 # v3.6
     with:
       go-package: ./...
 
@@ -30,7 +30,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@v3.2
+    uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@464e059fbd56372b085ea7956712d41bd6df59d0 # v3.6
     with:
       fail-on-severity: high
       comment-summary-in-pr: never
@@ -40,4 +40,4 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: OpenCHAMI/github-actions/.github/workflows/lint-workflows.yml@v3.2
+    uses: OpenCHAMI/github-actions/.github/workflows/lint-workflows.yml@464e059fbd56372b085ea7956712d41bd6df59d0 # v3.6
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 18f858aa..fe7d48e3 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -24,12 +24,12 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@v6.4.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
 
@@ -42,12 +42,12 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@v6.4.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
 
@@ -60,12 +60,12 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@v6.4.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod