From 3b380487f79f24e9b01720446ba6e27b77c1f9aa Mon Sep 17 00:00:00 2001
From: Jacob Oaks <joaks@uber.com>
Date: Tue, 12 Dec 2023 15:09:55 -0500
Subject: [PATCH] Reference workflow actions by SHA

This solves #139 by referencing actions by sha rather than directly by version.

We also update all of the actions we use at the same time.
---
 .github/workflows/go.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 8e9f05f..983d1ab 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -23,15 +23,15 @@ jobs:
 
     steps:
     - name: Setup Go
-      uses: actions/setup-go@v2
+      uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
       with:
         go-version: ${{ matrix.go }}
 
     - name: Checkout code
-      uses: actions/checkout@v2
+      uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2 # v4.0.0
 
     - name: Load cached dependencies
-      uses: actions/cache@v1
+      uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v.3.3.2
       with:
         path: ~/go/pkg/mod
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
@@ -46,4 +46,4 @@ jobs:
       run: make cover
 
     - name: Upload coverage to codecov.io
-      uses: codecov/codecov-action@v1
+      uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1