From b3ecc1de4e36384d1dcd733e5142181176986955 Mon Sep 17 00:00:00 2001
From: Johnathan Corgan <johnathan@corganlabs.com>
Date: Tue, 11 Aug 2026 16:42:42 +0000
Subject: [PATCH] Pin the action references that exist only on this line

The pinning sweep was authored on the maintenance branch, so it only ever saw
that branch's workflow files. This line carries package-freebsd.yml, which does
not exist there, and a ci.yml job block that does not either, so nine references
came through the merge still on mutable tags. The guard that landed with the
sweep then did exactly what it is for and failed the branch.

Those nine are now pinned in the same form, including the third-party FreeBSD VM
action that executes the whole build inside an image it controls. Each SHA was
resolved from the upstream peeled tag and checked back against it.

The lesson is worth keeping with the guard rather than in a commit message: a
checker authored on the earliest branch is only as complete as that branch's
file set, and merging it upward gates files it has never swept.
---
 .github/workflows/ci.yml              |  8 ++++----
 .github/workflows/package-freebsd.yml | 10 +++++-----
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c479b64..a1b0afb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -139,16 +139,16 @@ jobs:
     name: Android cross-check (aarch64)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - name: Install Rust toolchain (+ Android target)
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
         with:
           target: aarch64-linux-android
           components: clippy
           cache: false
           rustflags: ''
       - name: Cache Cargo registry + build
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: |
             ~/.cargo/registry
@@ -158,7 +158,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-cargo-
       - name: Install cargo-ndk
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2
         with:
           tool: cargo-ndk
       - name: Clippy the library for Android
diff --git a/.github/workflows/package-freebsd.yml b/.github/workflows/package-freebsd.yml
index 02ee1c7..3c12da7 100644
--- a/.github/workflows/package-freebsd.yml
+++ b/.github/workflows/package-freebsd.yml
@@ -20,7 +20,7 @@ jobs:
       freebsd_package_version: ${{ steps.freebsd_version.outputs.freebsd_package_version }}
       freebsd_pkg_file_version: ${{ steps.freebsd_version.outputs.freebsd_pkg_file_version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
 
@@ -60,7 +60,7 @@ jobs:
     needs: determine-versioning
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
 
@@ -68,7 +68,7 @@ jobs:
         run: echo "SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)" >> "$GITHUB_ENV"
 
       - name: Build and smoke-install in FreeBSD VM
-        uses: vmactions/freebsd-vm@v1
+        uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1
         env:
           FREEBSD_PACKAGE_VERSION: ${{ needs.determine-versioning.outputs.freebsd_package_version }}
         with:
@@ -186,7 +186,7 @@ jobs:
           echo "PASS: $(basename "$PKG") matches the in-VM SHA-256 ($actual)"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: fips_${{ needs.determine-versioning.outputs.freebsd_package_version }}_x86_64_freebsd
           path: |
@@ -209,7 +209,7 @@ jobs:
 
     steps:
       - name: Download FreeBSD artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           path: dist
           merge-multiple: true