ci: pin google/oss-fuzz actions to commit SHA in pr-fuzz workflow

[stu10887]

Summary

Pins the google/oss-fuzz action references in .github/workflows/pr-fuzz.yaml from @master to immutable full-length commit SHAs.

Rationale & Security Posture

Referencing mutable branch tags like @master poses supply-chain security risks, as upstream changes can introduce unexpected pipeline behaviors or vulnerabilities. Pinning actions to explicit commit hashes guarantees reproducible, audited execution.

Changes Made

• Updated google/oss-fuzz/infra/cifuzz/actions/build_fuzzers to use full commit SHA with inline # master comment.
• Updated google/oss-fuzz/infra/cifuzz/actions/run_fuzzers to use full commit SHA with inline # master comment.
• Verified locally using zizmor; error[unpinned-uses] findings are resolved.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• [ N/A ] Example configuration file for the change
• [ N/A ] Debug log output from testing the change

• [ N/A ] Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• [ N/A ] Run local packaging test showing all targets (including any new ones) build.
• [ N/A ] Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• [ N/A ] Documentation required for this feature

Backporting

• [ N/A ] Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• Chores
  • Pinned fuzz-testing workflow actions to a specific version for more consistent and reliable validation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 305caf88-417d-4e56-9daa-7603cf1abec4

📥 Commits

Reviewing files that changed from the base of the PR and between ae51533 and a643843.

📒 Files selected for processing (1)

• .github/workflows/pr-fuzz.yaml

---

📝 Walkthrough

Walkthrough

The CIFuzz pull request workflow now references a fixed commit for its build and run actions instead of the mutable master reference.

Changes

CIFuzz Action Pinning

Layer / File(s)	Summary
Pin CIFuzz workflow actions .github/workflows/pr-fuzz.yaml	The CIFuzz build and run steps now reference commit 4f0e722c2e974d4d61bec0e937cce4e710507cc6.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• fluent/fluent-bit#11593: Pins GitHub Actions to immutable commit SHAs in workflow files.

Suggested labels: ci, security

Suggested reviewers: celalettin1286

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes pinning the google/oss-fuzz actions to commit SHAs in the pr-fuzz workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}