From 3e5537ac553e9ca32d709c1aa9137b1c53ee9805 Mon Sep 17 00:00:00 2001
From: Noah Dietz <ndietz@google.com>
Date: Mon, 3 Aug 2026 19:02:07 +0000
Subject: [PATCH 1/2] chore(ci): fix action findings

---
 .github/workflows/ci.yaml      | 13 +++++++++----
 .github/workflows/release.yaml |  2 +-
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 8a009d7e0..0a995184a 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -6,11 +6,16 @@ on:
       - main
       - v1
       - v2
+
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   unit-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 1
           persist-credentials: false
@@ -21,7 +26,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 1
           persist-credentials: false
@@ -29,13 +34,13 @@ jobs:
         with:
           go-version-file: 'go.mod'
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9
+        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
         with:
           version: v2.12.1
   quality-checker:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 1
           persist-credentials: false
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 0bc27ef6b..357636f73 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -31,7 +31,7 @@ jobs:
           - os: windows
             arch: amd64
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.release.tag_name }}
           persist-credentials: false

From 390887cc2b1ba78afddab7f066e1e84baf16ae00 Mon Sep 17 00:00:00 2001
From: Noah Dietz <ndietz@google.com>
Date: Mon, 3 Aug 2026 19:27:08 +0000
Subject: [PATCH 2/2] chore(ci): use gh release upload

---
 .github/workflows/release.yaml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 357636f73..f6c1ff6e8 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -61,11 +61,10 @@ jobs:
         run: echo "raw_version=${TAG_NAME#v}" >> $GITHUB_OUTPUT
         shell: bash
       - name: Upload the ${{ matrix.osarch.os }}/${{ matrix.osarch.arch }} release.
-        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1
         env:
           GITHUB_TOKEN: ${{ github.token }}
-        with:
-          upload_url: ${{ github.event.release.upload_url }}
-          asset_path: ./api-linter.tar.gz
-          asset_name: api-linter-${{ steps.raw_tag.outputs.raw_version }}-${{ matrix.osarch.os }}-${{ matrix.osarch.arch }}.tar.gz
-          asset_content_type: application/tar+gzip
+          RAW_VERSION: ${{ steps.raw_tag.outputs.raw_version }}
+        run: |
+          gh release upload "$TAG_NAME" \
+            "./api-linter.tar.gz#api-linter-${RAW_VERSION}-${{ matrix.osarch.os }}-${{ matrix.osarch.arch }}.tar.gz" \
+            --clobber