From 87b6e3642e3f1a905c391abe448720e8eae639ce Mon Sep 17 00:00:00 2001
From: "Charlotte St. John" <cstjohn@twilio.com>
Date: Thu, 25 Jun 2026 18:26:24 -0500
Subject: [PATCH] ci: migrate runs-on to Twilio runner labels + SHA-pin actions

---
 .github/workflows/ci.yml | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f23289f5..6931f8fb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,11 +11,11 @@ on:
 
 jobs:
   setup:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-large
     outputs:
       version-tag: ${{ steps.regex-match.outputs.match }}
     steps:
-    - uses: actions-ecosystem/action-regex-match@v2
+    - uses: actions-ecosystem/action-regex-match@9e6c4fb3d5e898f505be7a1fb6e7b0a278f6665b  # v2
       id: regex-match
       with:
         text: ${{ github.ref_name }}
@@ -29,7 +29,7 @@ jobs:
 
 
   test270:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-large
     container:
       image: cimg/go:1.24.4
       env:
@@ -38,9 +38,9 @@ jobs:
         KAFKA_TOPICS_TEST_KAFKA_ADDR: kafka1:9092
     steps:
     - name: Check out repository code 
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
     - name: Go setup
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495  # v3
       with:
         go-version: 1.24.4
     - name: Display Go version
@@ -145,7 +145,7 @@ jobs:
           KAFKA_CFG_ALLOW_EVERYONE_IF_NO_ACL_FOUND: true
 
   test360:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-large
     container:
       image: cimg/go:1.24.4
       env:
@@ -154,9 +154,9 @@ jobs:
         KAFKA_TOPICS_TEST_KAFKA_ADDR: kafka1:9092
     steps:
     - name: Check out repository code 
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
     - name: Go setup
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495  # v3
       with:
         go-version: 1.24.4
     - name: Display Go version
@@ -262,17 +262,17 @@ jobs:
 
   publish-ghcr:
     needs: [setup, test270, test360]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-large
     if: ${{ ( github.ref_type == 'branch' ) && (( github.ref_name == 'master' ) || ( github.ref_name == 'v0' )) }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
     - name: setup env variables
       id: vars
       run: |
         echo "SHORT_SHA=${GITHUB_SHA:0:8}" >> $GITHUB_ENV
     - run: echo "publishing the image ghcr.io/segmentio/topicctl:${SHORT_SHA}"
     - name: Log in to the Container registry
-      uses: docker/login-action@v2
+      uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc  # v2
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
@@ -307,13 +307,13 @@ jobs:
     environment: CICD
     env: 
       RELEASE_TAG: ${{ needs.setup.outputs.version-tag }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-large
     if: ${{ ( github.ref_type == 'tag' ) && ( needs.setup.outputs.version-tag != '') }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744  # v3
     - run: echo "publishing the release version segment/topicctl:${RELEASE_TAG}"
     - name: Dockerhub login
-      uses: docker/login-action@v2
+      uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc  # v2
       with:
         username: ${{ vars.DOCKERHUB_USER }}
         password: ${{ secrets.DOCKERHUB_TOKEN }}