Securely pin versions in GitHub actions (#60)

* Pin commit hashes in github actions

* Fix lint

* Attempt to fix GitHub Actions workflow

---------

Co-authored-by: FluxCapacitor2 <31071265+FluxCapacitor2@users.noreply.github.com>

Author: skkra0

.github/workflows/lint.yml

@@ -10,9 +10,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: "npm"
@@ -31,7 +31,7 @@ jobs:
           npm ci
 
       - name: Install Tools
-        uses: jdx/mise-action@v4
+        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
           version: 2026.1.4
           install: true

.github/workflows/lint/lint.sh

@@ -50,7 +50,7 @@ check_error
 
 # Ajv: Helm templates
 printf "\n======================================\nRunning Ajv (charts/templates)\n======================================\n"
-cd "$PROJECT_ROOT/charts/templates" || exit 1
+cd "$PROJECT_ROOT/.github/workflows/lint" || exit 1
 ./validate-templates.sh
 check_error
 

charts/templates/validate-templates.sh …hub/workflows/lint/validate-templates.shcharts/templates/validate-templates.sh renamed to .github/workflows/lint/validate-templates.sh charts/templates/validate-templates.sh renamed to .github/workflows/lint/validate-templates.sh

@@ -1,6 +1,11 @@
 #!/bin/bash
 set -uo pipefail
 
+
+CURRENT_DIR=$(dirname "$0")
+TEMPLATE_DIR="$PWD/$CURRENT_DIR/../../../charts/templates"
+cd "$TEMPLATE_DIR" || exit 1
+
 tmp="$(mktemp -d)"
 
 status=0
@@ -10,7 +15,7 @@ for template in *; do
   if [[ -d "$template" && -f "$template/Chart.yaml" ]]; then
     echo "Validating $template"
     yq '.annotations."anvilops-values"' "$template/Chart.yaml" > "$tmp/$template-values.json"
-    if ! npx --yes ajv-cli@5 test \
+    if ! npx ajv-cli test \
       -s anvilops-values-schema.json \
       -d "$tmp/$template-values.json" \
       --valid \

.github/workflows/release.yml

@@ -25,7 +25,7 @@ jobs:
     if: ${{ inputs.environment }}
     steps:
       - name: Clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Log in to image registry (Production)
         if: ${{ inputs.environment == 'production' }}

.github/workflows/security-scan.yml

@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Tools
-        uses: jdx/mise-action@v4
+        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
         with:
           version: 2026.3.9
           install: true

.github/workflows/test-backend.yml

@@ -12,9 +12,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: "npm"

.github/workflows/update-railpack.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check and Update Version
         id: version_check
@@ -54,7 +54,7 @@ jobs:
 
       - name: Create Pull Request
         if: steps.version_check.outputs.updated == 'true'
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.UPDATE_RAILPACK_GITHUB_TOKEN }}
           commit-message: "Update Railpack to ${{ steps.version_check.outputs.new_version }}"