From 33bf748e8e205470a8e82a5a9e98f1275f8c1706 Mon Sep 17 00:00:00 2001
From: Gonzalo Diaz <devel@gon.cl>
Date: Sun, 27 Sep 2026 12:07:23 -0300
Subject: [PATCH] fix: [Github Actions] sonarcloud "Use full commit SHA hash
 for this dependency." fix: [BUGFIX] sonarcloud "Using dependencies without
 locking resolved versions is
 security-sensitive.sonarqube(githubactions:S8544)"

---
 .github/workflows/clang-format.yml |  4 ++--
 .github/workflows/gitleaks.yml     |  2 +-
 .github/workflows/sonarcloud.yml   | 10 +++-------
 3 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml
index c28c710..2d59774 100644
--- a/.github/workflows/clang-format.yml
+++ b/.github/workflows/clang-format.yml
@@ -25,9 +25,9 @@ jobs:
         # yamllint disable rule:line-length
         run: |
           sudo mkdir -p /etc/apt/keyrings
-          curl -fsSL https://apt.llvm.org/llvm-snapshot.gpg.key \
+          curl --proto '=https' --tlsv1.2 -fsSL https://apt.llvm.org/llvm-snapshot.gpg.key \
           | sudo gpg --dearmor -o /etc/apt/keyrings/llvm-snapshot.gpg
-          echo "deb [signed-by=/etc/apt/keyrings/llvm-snapshot.gpg] http://apt.llvm.org/resolute/ llvm-toolchain-resolute-22 main" \
+          echo "deb [signed-by=/etc/apt/keyrings/llvm-snapshot.gpg] https://apt.llvm.org/resolute/ llvm-toolchain-resolute-22 main" \
           | sudo tee /etc/apt/sources.list.d/llvm.list && \
           sudo apt-get -y update
           sudo apt-get -y install --no-install-recommends --no-install-suggests clang-format-22
diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
index aaf14b1..6629406 100644
--- a/.github/workflows/gitleaks.yml
+++ b/.github/workflows/gitleaks.yml
@@ -28,7 +28,7 @@ jobs:
       - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
-      - uses: gitleaks/gitleaks-action@v3
+      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # Only required for Organizations, not personal accounts.
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index 5d7465e..4c414a6 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -1,6 +1,8 @@
 ---
 name: SonarCloud
 
+# yamllint disable rule:line-length
+
 on: # yamllint disable-line rule:truthy
   push:
     branches: ["main"]
@@ -19,7 +21,7 @@ jobs:
       # Directory where build-wrapper output will be placed
       BUILD_WRAPPER_OUT_DIR: build
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           # Shallow clones should be disabled for a better relevancy of analysis
           fetch-depth: 0
@@ -48,17 +50,13 @@ jobs:
         run: |
           make dependencies
 
-      # yamllint disable rule:line-length
       - name: Install Build Wrapper
         uses: SonarSource/sonarqube-scan-action/install-build-wrapper@ba9859eae8dd6bd29e412f25ddbbef3d032000f4
-      # yamllint enable rule:line-length
 
-      # yamllint disable rule:line-length
       - name: Run build-wrapper
         run: |
           export VCPKG_ROOT=/usr/local/share/vcpkg
           build-wrapper-linux-x86-64 --out-dir ${{ env.BUILD_WRAPPER_OUT_DIR }} make build
-      # yamllint enable rule:line-length
       - name: Run tests to generate coverage statistics
         run: |
           make coverage
@@ -67,7 +65,6 @@ jobs:
         run: |
           gcovr -e "src/tests/*" --sonarqube > coverage.xml
 
-      # yamllint disable rule:line-length
       - name: Analyze with SonarQube / SonarCloud
         uses: SonarSource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4
         env:
@@ -77,4 +74,3 @@ jobs:
           args: >
             --define sonar.cfamily.compile-commands=${{ env.BUILD_WRAPPER_OUT_DIR }}/compile_commands.json
             --define sonar.coverageReportPaths=coverage.xml
-      # yamllint enable rule:line-length