From e0dfb4c89c9477089e64d9f9a8dd864ba00a1ba6 Mon Sep 17 00:00:00 2001
From: Jay Conrod <jay@engflow.com>
Date: Thu, 12 Nov 2026 14:09:14 -0800
Subject: [PATCH 1/2] CI: reference external actions by commit sha instead of
 branch or tag

Signed-off-by: Jay Conrod <jay@engflow.com>
---
 .github/workflows/main.yml    |  6 +++---
 .github/workflows/release.yml | 10 +++++-----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 90b31d1..57a56a5 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -51,7 +51,7 @@ jobs:
 
           - os: "macos"
             arch: "arm64"
-            runner: "macos-14"
+            runner: "macos-26"
             ef_config: "engflow_cache"
 
           - os: "windows"
@@ -64,7 +64,7 @@ jobs:
       OS: "${{ matrix.os }}"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: "Log in"
         shell: bash
@@ -96,7 +96,7 @@ jobs:
       OS: "linux"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Log in
         run: infra/login.sh
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2ceed60..d257de8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -46,7 +46,7 @@ jobs:
     timeout-minutes: 1
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - run: infra/release-check.sh
 
   build-artifacts:
@@ -76,7 +76,7 @@ jobs:
       OS: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Log in
         run: infra/login.sh
@@ -87,7 +87,7 @@ jobs:
         run: infra/release-build.sh
         shell: bash
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: success()
         with:
           name: ${{ matrix.os }}
@@ -107,8 +107,8 @@ jobs:
       - build-artifacts
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           path: _out
           merge-multiple: true

From 7948f96558b368f3b5d1b4075193478df3146ee8 Mon Sep 17 00:00:00 2001
From: Jay Conrod <jay@engflow.com>
Date: Thu, 12 Nov 2026 14:05:33 -0800
Subject: [PATCH 2/2] Go: upgrade to 1.27.4

Signed-off-by: Jay Conrod <jay@engflow.com>
---
 MODULE.bazel | 2 +-
 go.mod       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/MODULE.bazel b/MODULE.bazel
index c7c3c28..13177e9 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -11,7 +11,7 @@ bazel_dep(name = "rules_cc", version = "0.2.18")
 bazel_dep(name = "rules_go", version = "0.60.0")
 
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
-go_sdk.download(version = "1.26.2")
+go_sdk.download(version = "1.26.4")
 
 go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
 go_deps.from_file(go_mod = "//:go.mod")
diff --git a/go.mod b/go.mod
index a04fa5f..f37d9d6 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/EngFlow/auth
 
-go 1.25.0
+go 1.26.4
 
 require (
 	github.com/EngFlow/credential-helper-go v0.0.0-20260320063250-1f92d5f713f4