Change #267178

Category	None
Changed by	Viktor Szakats <commitohnoyoudont@vsz.me>
Changed at	Fri 15 May 2026 01:37:39
Repository	https://api.github.com/repos/curl/curl
Project	curl/curl
Branch	master
Revision	ef068fc8b7c2392cf1f322aa4420c8e94e767c02

Comments

GHA: pin containers to hash (where missing)

Fixing this with zizmor v1.25.0:
```
error[unpinned-images]: unpinned image references
  --> .github/workflows/linux-old.yml:59:5
59 |     container: 'debian:stretch'
   |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^ container image is not pinned to a SHA256 hash
   = help: audit documentation -> https://docs.zizmor.sh/audits/#unpinned-images
[...]
```
Ref: https://github.com/curl/curl/actions/runs/25890035949/job/76090925291?pr=21618

Sadly there is no automatic mechanism to bump them..

Also:
- replace `debian-stretch` with its slim variant.
- bump one of the two Alpine jobs from 3.20 to 3.23.4.

Closes #21619

Changed files

.github/workflows/linux-old.yml
.github/workflows/linux.yml