Commit 10739fda for libheif

commit 10739fdadc50857e4f5b3e8d0cdd9d0dfaa30765
Author: Dirk Farin <dirk.farin@gmail.com>
Date:   Thu Aug 27 00:12:50 2026 +0200

    ci: pin all GitHub actions to commit SHAs and add a dependabot cooldown

    Mutable tags like @v7 can be retargeted by whoever controls the action
    repository, and the CIFuzz actions tracked the head of the oss-fuzz
    master branch. Pin every action to the commit of its current release
    (checkout v7.0.1, cache v6.1.0, setup-go v6.5.0, upload-artifact v7.0.1)
    and the CIFuzz actions to the current oss-fuzz master commit. Dependabot
    keeps the SHAs current from the version comments; the 7-day cooldown
    gives compromised releases time to be noticed before they are picked up.

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 12301490..2663b123 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -2,5 +2,7 @@ version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
+    cooldown:
+      default-days: 7
     schedule:
       interval: "daily"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3d222c0b..c48577fb 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -27,7 +27,7 @@ jobs:
     env: ${{ matrix.env }}
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       with:
         persist-credentials: false

diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index c58358b2..a36cccfb 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -28,21 +28,21 @@ jobs:
     steps:
     - name: Build Fuzzers
       id: build
-      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@e004f85123eab0ba61ba5371c857239f97c1df27 # master, 2026-08-27
       with:
         oss-fuzz-project-name: 'libheif'
         dry-run: false
         architecture: ${{ matrix.architecture }}
         sanitizer: ${{ matrix.sanitizer }}
     - name: Run Fuzzers
-      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@e004f85123eab0ba61ba5371c857239f97c1df27 # master, 2026-08-27
       with:
         oss-fuzz-project-name: 'libheif'
         fuzz-seconds: 600
         dry-run: false
         sanitizer: ${{ matrix.sanitizer }}
     - name: Upload Crash
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
       if: failure() && steps.build.outcome == 'success'
       with:
         name: artifacts-${{ matrix.sanitizer }}-${{ matrix.architecture }}
diff --git a/.github/workflows/clang.yml b/.github/workflows/clang.yml
index 2ae2fd56..0685940b 100644
--- a/.github/workflows/clang.yml
+++ b/.github/workflows/clang.yml
@@ -19,7 +19,7 @@ jobs:
     env: ${{ matrix.env }}
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       with:
         persist-credentials: false

@@ -52,7 +52,7 @@ jobs:
       CLANG_TIDY: 1
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       with:
         persist-credentials: false

diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 7eb827cc..9a340fc4 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -19,12 +19,12 @@ jobs:
       WITH_RAV1E: 0
       WITH_X265: 1
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       with:
         persist-credentials: false

     - name: Cache Coverity build tool
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 #v6.1.0
       with:
         path: |
           coverity_tool.tar.gz
diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml
index 9a17e239..d7b5bec4 100644
--- a/.github/workflows/emscripten.yml
+++ b/.github/workflows/emscripten.yml
@@ -15,7 +15,7 @@ jobs:
       EMSCRIPTEN_VERSION: 3.1.61
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       with:
         persist-credentials: false

diff --git a/.github/workflows/fuzzer.yml b/.github/workflows/fuzzer.yml
index a47a8d43..c1c2a1b4 100644
--- a/.github/workflows/fuzzer.yml
+++ b/.github/workflows/fuzzer.yml
@@ -19,7 +19,7 @@ jobs:
       FUZZER: 1
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       with:
         persist-credentials: false

diff --git a/.github/workflows/gcc-versions.yml b/.github/workflows/gcc-versions.yml
index 364ae8ac..59b3d0cb 100644
--- a/.github/workflows/gcc-versions.yml
+++ b/.github/workflows/gcc-versions.yml
@@ -21,7 +21,7 @@ jobs:
     env: ${{ matrix.env }}
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       with:
         persist-credentials: false

diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 1ffec0da..8a10b1af 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -22,11 +22,11 @@ jobs:
       GO: 1
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       with:
         persist-credentials: false

-    - uses: actions/setup-go@v6
+    - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 #v6.5.0
       with:
         go-version: "1.10"

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 4f0c0e56..f8eb68eb 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -15,7 +15,7 @@ jobs:
       CPPLINT: 1
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       with:
         persist-credentials: false

@@ -34,7 +34,7 @@ jobs:
   c-api-headers:
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       with:
         persist-credentials: false

@@ -50,7 +50,7 @@ jobs:
   api-symbols:
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       with:
         persist-credentials: false

@@ -68,7 +68,7 @@ jobs:
       CHECK_LICENSES: 1
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       with:
         persist-credentials: false

diff --git a/.github/workflows/mingw.yml b/.github/workflows/mingw.yml
index 7fb5b5a2..82948198 100644
--- a/.github/workflows/mingw.yml
+++ b/.github/workflows/mingw.yml
@@ -19,7 +19,7 @@ jobs:
     env: ${{ matrix.env }}
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       with:
         persist-credentials: false

diff --git a/.github/workflows/osx.yml b/.github/workflows/osx.yml
index 6fe7a67f..c751c1c0 100644
--- a/.github/workflows/osx.yml
+++ b/.github/workflows/osx.yml
@@ -21,7 +21,7 @@ jobs:
     env: ${{ matrix.env }}
     runs-on: ${{ matrix.runner }}
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       with:
         persist-credentials: false

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2eb528fe..2328a5dc 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,7 +18,7 @@ jobs:
       WITH_X265: 1
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
       with:
         persist-credentials: false