Merge pull request #328 from roundcube/workflow-pin-commits

diff --cc .github/workflows/build.yml
index b3b746b14bfb2d04565f99100b9a0cf1f3d67af0,73ed242f7f222e9c82131af03b7897eed8caf8a5..187b6fa428da7b07d22f91dcf8ab5ebe3fd1dc7f
--- 1/.github/workflows/build.yml
--- 2/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@@ -40,25 -38,9 +40,25 @@@ jobs
              test-files: 'fpm-postgres'
              docker-tag: roundcube/roundcubemail:1.6.x-fpm-alpine,roundcube/roundcubemail:1.6.10-fpm-alpine,roundcube/roundcubemail:latest-fpm-alpine
              test-tag: roundcube/roundcubemail:latest-fpm-alpine
 +            target: 'root'
 +          - variant: 'apache'
 +            test-files: 'apache-postgres'
 +            docker-tag: roundcube/roundcubemail:1.6.x-apache-nonroot,roundcube/roundcubemail:1.6.10-apache-nonroot,roundcube/roundcubemail:latest-apache-nonroot,roundcube/roundcubemail:latest-nonroot
 +            test-tag: roundcube/roundcubemail:latest-apache-nonroot
 +            target: 'nonroot'
 +          - variant: 'fpm'
 +            test-files: 'apache-postgres'
 +            docker-tag: roundcube/roundcubemail:1.6.x-fpm-nonroot,roundcube/roundcubemail:1.6.10-fpm-nonroot,roundcube/roundcubemail:latest-fpm-nonroot
 +            test-tag: roundcube/roundcubemail:latest-fpm-nonroot
 +            target: 'nonroot'
 +          - variant: 'fpm-alpine'
 +            test-files: 'apache-postgres'
 +            docker-tag: roundcube/roundcubemail:1.6.x-fpm-alpine-nonroot,roundcube/roundcubemail:1.6.10-fpm-alpine-nonroot,roundcube/roundcubemail:latest-fpm-alpine-nonroot
 +            test-tag: roundcube/roundcubemail:latest-fpm-alpine-nonroot
 +            target: 'nonroot'
      steps:
        - name: Checkout repository
-         uses: actions/checkout@v4
+         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        - name: Get docker hub username
          id: creds
          run: echo '::set-output name=username::${{ secrets.DOCKER_PULL_USERNAME }}'

diff --cc .github/workflows/test.yml
index baa06e986970ce740f41db884ed733d2742d7bd2,cc1599ddd604c18fca52a72359e6a38b4eeb23d2..a946b3cd8b807623fa5f4038a73ef85ac05394d9
--- 1/.github/workflows/test.yml
--- 2/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@@ -28,23 -26,9 +28,23 @@@ jobs
            - variant: 'fpm-alpine'
              test-files: 'fpm-postgres'
              docker-tag: roundcube/roundcubemail:test-fpm-alpine
 +            target: 'root'
 +          - variant: 'apache'
 +            test-files: 'apache-postgres'
 +            docker-tag: roundcube/roundcubemail:test-apache-nonroot
 +            target: 'nonroot'
 +            http-port: '8000'
 +          - variant: 'fpm'
 +            test-files: 'fpm-postgres'
 +            docker-tag: roundcube/roundcubemail:test-fpm-nonroot
 +            target: 'nonroot'
 +          - variant: 'fpm-alpine'
 +            test-files: 'fpm-postgres'
 +            docker-tag: roundcube/roundcubemail:test-fpm-alpine-nonroot
 +            target: 'nonroot'
      steps:
        - name: Checkout repository
-         uses: actions/checkout@v4
+         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        - name: Get docker hub username
          id: creds
          run: echo '::set-output name=username::${{ secrets.DOCKER_PULL_USERNAME }}'