From e0dfb4c89c9477089e64d9f9a8dd864ba00a1ba6 Mon Sep 17 00:00:00 2001
From: Jay Conrod <jay@engflow.com>
Date: Thu, 12 Nov 2026 14:09:14 -0800
Subject: [PATCH] CI: reference external actions by commit sha instead of
 branch or tag

Signed-off-by: Jay Conrod <jay@engflow.com>
---
 .github/workflows/main.yml    |  6 +++---
 .github/workflows/release.yml | 10 +++++-----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 90b31d1..57a56a5 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -51,7 +51,7 @@ jobs:
 
           - os: "macos"
             arch: "arm64"
-            runner: "macos-14"
+            runner: "macos-26"
             ef_config: "engflow_cache"
 
           - os: "windows"
@@ -64,7 +64,7 @@ jobs:
       OS: "${{ matrix.os }}"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: "Log in"
         shell: bash
@@ -96,7 +96,7 @@ jobs:
       OS: "linux"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Log in
         run: infra/login.sh
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2ceed60..d257de8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -46,7 +46,7 @@ jobs:
     timeout-minutes: 1
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - run: infra/release-check.sh
 
   build-artifacts:
@@ -76,7 +76,7 @@ jobs:
       OS: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Log in
         run: infra/login.sh
@@ -87,7 +87,7 @@ jobs:
         run: infra/release-build.sh
         shell: bash
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: success()
         with:
           name: ${{ matrix.os }}
@@ -107,8 +107,8 @@ jobs:
       - build-artifacts
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           path: _out
           merge-multiple: true