github:lock actions to commit

.github/actions/setup-node/action.yml

@@ -5,7 +5,7 @@ runs:
   steps:
     - run: sudo apt -y install build-essential openssl libssl-dev pkg-config liblz4-tool clang
       shell: bash
-    - uses: actions/cache/restore@v4
+    - uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf
       # Restore most recent cache if available.
       with:
         path: |

.github/workflows/build.yml

@@ -43,7 +43,7 @@ jobs:
           delay=$((1 + $RANDOM % 32))
           echo "Waiting ${delay} seconds before execution"
           sleep $delay
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: Preflight step to set up the runner
         uses: ./.github/actions/setup-node
       - run: rustup component add rustfmt

.github/workflows/cache.yml

@@ -18,7 +18,7 @@ jobs:
     permissions:
       actions: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       # Install dependencies for twoliter and cargo-make.
       - run: sudo apt -y install build-essential openssl libssl-dev pkg-config liblz4-tool
         shell: bash
@@ -47,7 +47,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         continue-on-error: true
       # This caches the reusable artifacts for future CI runs.
-      - uses: actions/cache/save@v4
+      - uses: actions/cache/save@d4323d4df104b026a6aa633fdb11d772146be0bf
         # Save Rust dependencies
         with:
           path: |

.github/workflows/golangci-lint.yaml

@@ -14,17 +14,17 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34
         with:
           go-version: 1.21
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: lint-host-ctr
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84
         with:
           version: latest
           working-directory: sources/host-ctr
       - name: lint-ecs-gpu-init
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84
         with:
           version: latest
           working-directory: sources/ecs-gpu-init

.github/workflows/validate-changelog.yml

@@ -9,5 +9,5 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - run: ./tools/validate-changelog.sh

sources/host-ctr/cmd/host-ctr/main.go

@@ -18,13 +18,13 @@ import (
 	"github.com/aws/aws-sdk-go/service/ecrpublic"
 	"github.com/awslabs/amazon-ecr-containerd-resolver/ecr"
 	"github.com/containerd/containerd"
+	"github.com/containerd/containerd/api/types/runc/options"
 	"github.com/containerd/containerd/cio"
 	"github.com/containerd/containerd/containers"
 	"github.com/containerd/containerd/contrib/seccomp"
 	"github.com/containerd/containerd/namespaces"
 	"github.com/containerd/containerd/oci"
 	"github.com/containerd/containerd/remotes/docker"
-	"github.com/containerd/containerd/runtime/v2/runc/options"
 	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
 	runtimespec "github.com/opencontainers/runtime-spec/specs-go"