From 60917c85e2f6645e21846fcf0197ff18244c747d Mon Sep 17 00:00:00 2001
From: "Stephen Lewis (Burrows)" <stephenrlewis@google.com>
Date: Fri, 22 Mar 2024 09:33:14 -0700
Subject: [PATCH] Pin workflow dependency versions (#10256)

* Pinned python yaml library versions

* Pinned goimports version in build-downstreams

* Force generation

* Revert "Force generation"

This reverts commit b2d876045277156ae2fd3a44194fe58164297186.
---
 .github/workflows/build-downstream.yml       | 2 +-
 .github/workflows/mmv1-lint-product-yaml.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-downstream.yml b/.github/workflows/build-downstream.yml
index 4cfa5aa2bac..ab0dbd43dc1 100644
--- a/.github/workflows/build-downstream.yml
+++ b/.github/workflows/build-downstream.yml
@@ -58,7 +58,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-go-
 
-      - run: go install golang.org/x/tools/cmd/goimports@latest
+      - run: go install golang.org/x/tools/cmd/goimports@7656c4c657688cae30795365d2a5f30d6f18be7f # v0.19.0
 
       - name: Build ${{ inputs.repo  }}
         run: |
diff --git a/.github/workflows/mmv1-lint-product-yaml.yml b/.github/workflows/mmv1-lint-product-yaml.yml
index a857f40c3a7..c4d91e19371 100644
--- a/.github/workflows/mmv1-lint-product-yaml.yml
+++ b/.github/workflows/mmv1-lint-product-yaml.yml
@@ -30,7 +30,7 @@ jobs:
           fi
       - name: Install yamllint
         if: ${{ !failure() && steps.pull_request.outputs.yamlfiles != '' }}
-        run: pip install yamllint
+        run: pip install yamllint==1.32.0 pyyaml==6.0.1 --no-deps
       - name: Lint YAML files
         if: ${{ !failure() && steps.pull_request.outputs.yamlfiles != '' }}
         run: yamllint -c repo/.yamllint ${{steps.pull_request.outputs.yamlfiles}}