From ab88eaaa658ddba1c2a691a5f2e2fd400bfdd36a Mon Sep 17 00:00:00 2001
From: Takahisa Iwamoto <takahisa_iwamoto@caddi.jptakahisa_iwamoto@caddi.jp>
Date: Tue, 31 Mar 2026 12:50:24 +0900
Subject: [PATCH] ci: pin GitHub Actions to commit hashes via pinact

---
 .github/workflows/build.yml     | 16 ++++++++--------
 .github/workflows/build_pat.yml |  2 +-
 .github/workflows/deploy.yml    |  4 ++--
 .github/workflows/lint.yml      |  4 ++--
 4 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 31d063a16f3..a21b348fbc5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -48,9 +48,9 @@ jobs:
             torchvision: 0.10.0
             mmcv: 1.9.0
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install Pillow
@@ -109,9 +109,9 @@ jobs:
             mmcv: 1.8.0
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install system dependencies
@@ -147,7 +147,7 @@ jobs:
           coverage xml
           coverage report -m
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v1.0.10
+        uses: codecov/codecov-action@f3570723ef743f6942b6a480461ed0cd6c0f9baa # v1.0.10
         with:
           file: ./coverage.xml
           flags: unittests
@@ -171,9 +171,9 @@ jobs:
             mmcv: 1.9.0
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4
         with:
           python-version: ${{ matrix.python-version }}
       # Add ppa source repo for python3.9.
@@ -220,7 +220,7 @@ jobs:
           coverage xml
           coverage report -m
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v2
+        uses: codecov/codecov-action@f32b3a3741e1053eb607407145bc9619351dc93b # v2.1.0
         with:
           files: ./coverage.xml
           flags: unittests
diff --git a/.github/workflows/build_pat.yml b/.github/workflows/build_pat.yml
index 438e27ed8a5..67f8964b39f 100644
--- a/.github/workflows/build_pat.yml
+++ b/.github/workflows/build_pat.yml
@@ -16,7 +16,7 @@ jobs:
         password: ${{ secrets.CR_PAT }}
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       - name: Install mmdet dependencies
         run: |
           git clone https://github.com/open-mmlab/mmcv.git && cd mmcv
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index f575061468b..76f5edd722e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -11,9 +11,9 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.event.ref, 'refs/tags')
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       - name: Set up Python 3.7
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4
         with:
           python-version: 3.7
       - name: Install torch
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 91565fe36af..44ce95d809f 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -10,9 +10,9 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       - name: Set up Python 3.7
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4
         with:
           python-version: 3.7
       - name: Install pre-commit hook