From 73d9ff28ca6dbd0c90f7c62bff0f6bc50467c12f Mon Sep 17 00:00:00 2001
From: Lakshman Patel <Lakshmanp230@gmail.com>
Date: Mon, 13 Jul 2026 19:12:05 +0530
Subject: [PATCH] fix(ci): repin goreleaser + trufflehog at the template
 source, not just the render
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR #95 fixed hawk's rendered release.yml but left the actual source of
truth, .shared-templates/workflows/go-release.yml.tmpl, still pinned to
the nonexistent goreleaser "v6.3.0" — any future template re-sync would
have silently reintroduced the bug. Repins both the template and hawk's
own rendered copy to the real, current v2.17.0 (matching tok's already-
correct exact-pin pattern instead of a floating "~> v2" constraint).

Also repins trufflehog from a commit SHA labeled "main 2026-05-18" (a
floating branch reference, not a release) to its actual v3.95.9 release
tag, in both go-ci.yml.tmpl and hawk's own rendered ci.yml.
---
 .github/workflows/ci.yml                        | 2 +-
 .github/workflows/release.yml                   | 4 +++-
 .shared-templates/workflows/go-ci.yml.tmpl      | 2 +-
 .shared-templates/workflows/go-release.yml.tmpl | 4 +++-
 4 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2b2931d8..2eb5d669 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -281,7 +281,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: trufflesecurity/trufflehog@0fa069c12f0c7baf431041cd1e564a9c5058846c # main 2026-05-18
+      - uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.95.9
         with:
           extra_args: --only-verified
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7e7aeb1f..c74e5910 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -60,7 +60,9 @@ jobs:
         uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7.2.1
         with:
           distribution: goreleaser
-          version: "~> v2"
+          # Must match a real goreleaser release — verify at
+          # https://github.com/goreleaser/goreleaser/releases before bumping.
+          version: "v2.17.0"
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.shared-templates/workflows/go-ci.yml.tmpl b/.shared-templates/workflows/go-ci.yml.tmpl
index 8233e3f7..cae1946e 100644
--- a/.shared-templates/workflows/go-ci.yml.tmpl
+++ b/.shared-templates/workflows/go-ci.yml.tmpl
@@ -193,7 +193,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: trufflesecurity/trufflehog@0fa069c12f0c7baf431041cd1e564a9c5058846c # main 2026-05-18
+      - uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.95.9
         with:
           extra_args: --only-verified
 
diff --git a/.shared-templates/workflows/go-release.yml.tmpl b/.shared-templates/workflows/go-release.yml.tmpl
index 6f496915..15443054 100644
--- a/.shared-templates/workflows/go-release.yml.tmpl
+++ b/.shared-templates/workflows/go-release.yml.tmpl
@@ -36,7 +36,9 @@ jobs:
         uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7.2.1
         with:
           distribution: goreleaser
-          version: "v6.3.0"
+          # Must match a real goreleaser release — verify at
+          # https://github.com/goreleaser/goreleaser/releases before bumping.
+          version: "v2.17.0"
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}