From c01b16b3b7bbc30ba828c0dbe6d30d8205dc4de2 Mon Sep 17 00:00:00 2001
From: tintinhamans <5984296+tintinhamans@users.noreply.github.com>
Date: Mon, 2 Mar 2026 14:23:27 +0100
Subject: [PATCH 1/8] ci(actions): Update actions/checkout to version v6.0.2

Signed-off-by: tintinhamans <5984296+tintinhamans@users.noreply.github.com>
---
 .github/workflows/build-historical.yml      | 4 ++--
 .github/workflows/build-toolchain.yml       | 2 +-
 .github/workflows/check-replays.yml         | 2 +-
 .github/workflows/ci.yml                    | 2 +-
 .github/workflows/validate-pull-request.yml | 2 +-
 .github/workflows/weekly-release.yml        | 4 ++--
 6 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/build-historical.yml b/.github/workflows/build-historical.yml
index 46dd7daa7f3..4507d4bcf29 100644
--- a/.github/workflows/build-historical.yml
+++ b/.github/workflows/build-historical.yml
@@ -48,7 +48,7 @@ jobs:
       release_tag: ${{ steps.info.outputs.release_tag }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -97,7 +97,7 @@ jobs:
 
     steps:
       - name: Checkout Target Commit
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.event.inputs.commit }}
           fetch-depth: 0
diff --git a/.github/workflows/build-toolchain.yml b/.github/workflows/build-toolchain.yml
index e7494c8473f..17a4a2c97cb 100644
--- a/.github/workflows/build-toolchain.yml
+++ b/.github/workflows/build-toolchain.yml
@@ -39,7 +39,7 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Cache VC6 Installation
         if: startsWith(inputs.preset, 'vc6')
diff --git a/.github/workflows/check-replays.yml b/.github/workflows/check-replays.yml
index 0f10f67d85b..bcace9dfa4a 100644
--- a/.github/workflows/check-replays.yml
+++ b/.github/workflows/check-replays.yml
@@ -31,7 +31,7 @@ jobs:
       GENERALSMD_PATH: C:\GameData\GeneralsMD
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: true
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0420bc2e276..88226ead4d2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,7 +28,7 @@ jobs:
       shared: ${{ steps.filter.outputs.shared }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Filter Changed Paths
         uses: dorny/paths-filter@v3
diff --git a/.github/workflows/validate-pull-request.yml b/.github/workflows/validate-pull-request.yml
index 9112cbd8e1c..259e2ce28d2 100644
--- a/.github/workflows/validate-pull-request.yml
+++ b/.github/workflows/validate-pull-request.yml
@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Checkout base branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.base_ref }}
           fetch-depth: 0
diff --git a/.github/workflows/weekly-release.yml b/.github/workflows/weekly-release.yml
index c127d9e5f02..b1c975e6e12 100644
--- a/.github/workflows/weekly-release.yml
+++ b/.github/workflows/weekly-release.yml
@@ -57,7 +57,7 @@ jobs:
     outputs:
       changed: ${{ steps.check.outputs.changed }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -129,7 +129,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           fetch-tags: true

From 615d47a6b7cc74283f0295c1a9f3d638b3a8fc93 Mon Sep 17 00:00:00 2001
From: tintinhamans <5984296+tintinhamans@users.noreply.github.com>
Date: Mon, 2 Mar 2026 14:29:12 +0100
Subject: [PATCH 2/8] ci(actions): Update actions/cache to version v5.0.3

Signed-off-by: tintinhamans <5984296+tintinhamans@users.noreply.github.com>
---
 .github/workflows/build-historical.yml | 2 +-
 .github/workflows/build-toolchain.yml  | 8 ++++----
 .github/workflows/check-replays.yml    | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/build-historical.yml b/.github/workflows/build-historical.yml
index 4507d4bcf29..32d472a35de 100644
--- a/.github/workflows/build-historical.yml
+++ b/.github/workflows/build-historical.yml
@@ -136,7 +136,7 @@ jobs:
 
       - name: Cache VC6 Installation
         id: cache-vc6
-        uses: actions/cache@v4
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: C:\VC6
           key: vc6-permanent-cache-v2
diff --git a/.github/workflows/build-toolchain.yml b/.github/workflows/build-toolchain.yml
index 17a4a2c97cb..86f049a06f4 100644
--- a/.github/workflows/build-toolchain.yml
+++ b/.github/workflows/build-toolchain.yml
@@ -44,14 +44,14 @@ jobs:
       - name: Cache VC6 Installation
         if: startsWith(inputs.preset, 'vc6')
         id: cache-vc6
-        uses: actions/cache@v4
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: C:\VC6
           key: vc6-permanent-cache-v2
 
       - name: Cache CMake Dependencies
         id: cache-cmake-deps
-        uses: actions/cache@v4
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: build\${{ inputs.preset }}\_deps
           key: cmake-deps-${{ inputs.preset }}-${{ hashFiles('CMakePresets.json','cmake/**/*.cmake','**/CMakeLists.txt') }}
@@ -123,7 +123,7 @@ jobs:
       - name: Restore vcpkg binary cache
         if: startsWith(inputs.preset, 'win32')
         id: vcpkg_cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: ${{ github.workspace }}\vcpkg-bincache
           key: vcpkg-bincache-v3-${{ runner.os }}-baseline${{ steps.vcpkg_key.outputs.baseline }}-${{ steps.vcpkg_key.outputs.triplet }}-${{ hashFiles('triplets/*.cmake') }}
@@ -178,7 +178,7 @@ jobs:
       - name: Save vcpkg binary cache
         # Only one job should save to avoid "Unable to reserve cache" conflicts.
         if: ${{ startsWith(inputs.preset, 'win32') && steps.vcpkg_cache.outputs.cache-hit != 'true' && inputs.game == 'Generals' && inputs.preset == 'win32-vcpkg-debug' }}
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: ${{ github.workspace }}\vcpkg-bincache
           key: vcpkg-bincache-v3-${{ runner.os }}-baseline${{ steps.vcpkg_key.outputs.baseline }}-${{ steps.vcpkg_key.outputs.triplet }}-${{ hashFiles('triplets/*.cmake') }}
diff --git a/.github/workflows/check-replays.yml b/.github/workflows/check-replays.yml
index bcace9dfa4a..b9db2f36348 100644
--- a/.github/workflows/check-replays.yml
+++ b/.github/workflows/check-replays.yml
@@ -43,7 +43,7 @@ jobs:
 
       - name: Cache Game Data
         id: cache-gamedata
-        uses: actions/cache@v4
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: ${{ env.GAME_PATH }}
           key: gamedata-permanent-cache-v4

From 0cdb54ec06097d01eda7589e98af2ddc3b60dfd5 Mon Sep 17 00:00:00 2001
From: tintinhamans <5984296+tintinhamans@users.noreply.github.com>
Date: Mon, 2 Mar 2026 14:32:48 +0100
Subject: [PATCH 3/8] ci(actions): Update actions/upload-artifact to version
 v7.0.0

Signed-off-by: tintinhamans <5984296+tintinhamans@users.noreply.github.com>
---
 .github/workflows/build-historical.yml | 2 +-
 .github/workflows/build-toolchain.yml  | 2 +-
 .github/workflows/check-replays.yml    | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build-historical.yml b/.github/workflows/build-historical.yml
index 32d472a35de..534c160b0c7 100644
--- a/.github/workflows/build-historical.yml
+++ b/.github/workflows/build-historical.yml
@@ -204,7 +204,7 @@ jobs:
           $files | Move-Item -Destination $artifactsDir -Force
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: ${{ matrix.game }}-vc6-${{ needs.prepare.outputs.short_sha }}
           path: build\vc6\${{ matrix.game }}\artifacts
diff --git a/.github/workflows/build-toolchain.yml b/.github/workflows/build-toolchain.yml
index 86f049a06f4..9e605f296cf 100644
--- a/.github/workflows/build-toolchain.yml
+++ b/.github/workflows/build-toolchain.yml
@@ -201,7 +201,7 @@ jobs:
           $files | Move-Item -Destination $artifactsDir -Verbose -Force
 
       - name: Upload ${{ inputs.game }} ${{ inputs.preset }}${{ inputs.tools && '+t' || '' }}${{ inputs.extras && '+e' || '' }} Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: ${{ inputs.game }}-${{ inputs.preset }}${{ inputs.tools && '+t' || '' }}${{ inputs.extras && '+e' || '' }}
           path: build\${{ inputs.preset }}\${{ inputs.game }}\artifacts
diff --git a/.github/workflows/check-replays.yml b/.github/workflows/check-replays.yml
index b9db2f36348..2db86cf54cb 100644
--- a/.github/workflows/check-replays.yml
+++ b/.github/workflows/check-replays.yml
@@ -234,7 +234,7 @@ jobs:
 
       - name: Upload Debug Log
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: Replay-Debug-Log-${{ inputs.preset }}
           path: build/DebugLogFile*.txt

From 9cec15278d68697e4db3baf3fb66be2d7f298409 Mon Sep 17 00:00:00 2001
From: tintinhamans <5984296+tintinhamans@users.noreply.github.com>
Date: Mon, 2 Mar 2026 14:35:17 +0100
Subject: [PATCH 4/8] ci(actions): Update actions/download-artifact to version
 v8.0.0

Signed-off-by: tintinhamans <5984296+tintinhamans@users.noreply.github.com>
---
 .github/workflows/build-historical.yml | 4 ++--
 .github/workflows/check-replays.yml    | 2 +-
 .github/workflows/weekly-release.yml   | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build-historical.yml b/.github/workflows/build-historical.yml
index 534c160b0c7..e5134db3fba 100644
--- a/.github/workflows/build-historical.yml
+++ b/.github/workflows/build-historical.yml
@@ -218,14 +218,14 @@ jobs:
     steps:
       - name: Download Generals Artifact
         if: ${{ github.event.inputs.game == 'Generals' || github.event.inputs.game == 'Both' }}
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
           name: Generals-vc6-${{ needs.prepare.outputs.short_sha }}
           path: generals-artifacts
 
       - name: Download GeneralsMD Artifact
         if: ${{ github.event.inputs.game == 'GeneralsMD' || github.event.inputs.game == 'Both' }}
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
           name: GeneralsMD-vc6-${{ needs.prepare.outputs.short_sha }}
           path: generalsmd-artifacts
diff --git a/.github/workflows/check-replays.yml b/.github/workflows/check-replays.yml
index 2db86cf54cb..5f27c600bef 100644
--- a/.github/workflows/check-replays.yml
+++ b/.github/workflows/check-replays.yml
@@ -36,7 +36,7 @@ jobs:
           submodules: true
 
       - name: Download Game Artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
           name: ${{ inputs.game }}-${{ inputs.preset }}
           path: build
diff --git a/.github/workflows/weekly-release.yml b/.github/workflows/weekly-release.yml
index b1c975e6e12..c723c7e47ec 100644
--- a/.github/workflows/weekly-release.yml
+++ b/.github/workflows/weekly-release.yml
@@ -154,7 +154,7 @@ jobs:
 
       # Generals vc6
       - name: Download Generals VC6 Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
           name: Generals-vc6-weekly+t
           path: generals-vc6-artifacts
@@ -165,7 +165,7 @@ jobs:
 
       # GeneralsMD vc6
       - name: Download GeneralsMD VC6 Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
           name: GeneralsMD-vc6-weekly+t
           path: generalsmd-vc6-artifacts

From b7ea84048ec55a41a9bf6fd554f6cd974c942cef Mon Sep 17 00:00:00 2001
From: tintinhamans <5984296+tintinhamans@users.noreply.github.com>
Date: Mon, 2 Mar 2026 14:37:00 +0100
Subject: [PATCH 5/8] ci(actions): Update softprops/action-gh-release to
 version v2.5.0

Signed-off-by: tintinhamans <5984296+tintinhamans@users.noreply.github.com>
---
 .github/workflows/build-historical.yml | 2 +-
 .github/workflows/weekly-release.yml   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-historical.yml b/.github/workflows/build-historical.yml
index e5134db3fba..1d916e90783 100644
--- a/.github/workflows/build-historical.yml
+++ b/.github/workflows/build-historical.yml
@@ -264,7 +264,7 @@ jobs:
           echo "EOF" >> $GITHUB_OUTPUT
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
         with:
           tag_name: ${{ needs.prepare.outputs.release_tag }}
           name: ${{ needs.prepare.outputs.release_tag }}
diff --git a/.github/workflows/weekly-release.yml b/.github/workflows/weekly-release.yml
index c723c7e47ec..81cf2a5d9f3 100644
--- a/.github/workflows/weekly-release.yml
+++ b/.github/workflows/weekly-release.yml
@@ -190,7 +190,7 @@ jobs:
           echo "EOF" >> $GITHUB_OUTPUT
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
         with:
           tag_name: weekly-${{ needs.get-date.outputs.date }}
           name: weekly-${{ needs.get-date.outputs.date }}

From 77d3a475b60e6096c32b93eaa67d1d8a02cff816 Mon Sep 17 00:00:00 2001
From: tintinhamans <5984296+tintinhamans@users.noreply.github.com>
Date: Tue, 10 Mar 2026 09:44:11 +0100
Subject: [PATCH 6/8] ci(actions): Update ilammy/msvc-dev-cmd action to version
 v1.13.0

---
 .github/workflows/build-toolchain.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-toolchain.yml b/.github/workflows/build-toolchain.yml
index 9e605f296cf..e244951bc9c 100644
--- a/.github/workflows/build-toolchain.yml
+++ b/.github/workflows/build-toolchain.yml
@@ -101,7 +101,7 @@ jobs:
 
       - name: Set Up VC2022 Environment
         if: startsWith(inputs.preset, 'win32')
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
         with:
           arch: x86
 

From 903073d6f88399179ad411966b77c59453bcfc21 Mon Sep 17 00:00:00 2001
From: tintinhamans <5984296+tintinhamans@users.noreply.github.com>
Date: Tue, 10 Mar 2026 09:44:23 +0100
Subject: [PATCH 7/8] ci(actions): Update lukka/run-vcpkg action to version
 v11.5

---
 .github/workflows/build-toolchain.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-toolchain.yml b/.github/workflows/build-toolchain.yml
index e244951bc9c..6b19e968769 100644
--- a/.github/workflows/build-toolchain.yml
+++ b/.github/workflows/build-toolchain.yml
@@ -132,7 +132,7 @@ jobs:
             vcpkg-bincache-v3-${{ runner.os }}-
 
       - name: Setup vcpkg
-        uses: lukka/run-vcpkg@v11
+        uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5
         with:
           runVcpkgInstall: false
           doNotCache: true

From 42d64069f8fc93ec25c1d86380c423413cee8a41 Mon Sep 17 00:00:00 2001
From: tintinhamans <5984296+tintinhamans@users.noreply.github.com>
Date: Mon, 2 Mar 2026 14:39:33 +0100
Subject: [PATCH 8/8] ci(actions): Update dorny/paths-filter action to version
 v3.0.2

Signed-off-by: tintinhamans <5984296+tintinhamans@users.noreply.github.com>
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 88226ead4d2..7069fa9c146 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,7 +31,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Filter Changed Paths
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: filter
         with:
           token: ''