From ed4c8af4436305fcf34c0926c687331175557be3 Mon Sep 17 00:00:00 2001
From: Matyas Selmeci <mselmeci@wisc.edu>
Date: Wed, 5 Aug 2026 18:31:05 -0500
Subject: [PATCH] Bump component actions to latest and pin their versions

---
 action.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/action.yml b/action.yml
index f5b9a50..0c8d90f 100644
--- a/action.yml
+++ b/action.yml
@@ -63,7 +63,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-  - uses: actions/checkout@v3
+  - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     with:
       clean: ${{ inputs.clean_before_build }}
 
@@ -120,23 +120,23 @@ runs:
       echo "taglist=${tag_list[*]}" >> $GITHUB_OUTPUT
 
   - name: Import Docker images from cache
-    uses: actions/cache@v4
+    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
     with:
       path: /tmp/.buildx-cache
       key: ${{ steps.generate-image-name.outputs.image }}_${{ inputs.osg_series}}_${{ inputs.repo }}_buildx_${{ github.sha }}_${{ github.run_id }}
 
   - name: Set up Docker Buildx
-    uses: docker/setup-buildx-action@v1
+    uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
   - name: Log in to ${{ inputs.registry_url }}
-    uses: docker/login-action@v1
+    uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
     with:
       registry: ${{ inputs.registry_url }}
       username: ${{ inputs.registry_user }}
       password: ${{ inputs.registry_pass }}
 
   - name: Build image
-    uses: docker/build-push-action@v2.8.0
+    uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
     with:
       push: true
       context: ${{ inputs.context }}