Pin GitHub Actions to SHA for security

Update official GitHub Actions (actions/*, github/*) to use pinned
commit SHAs instead of version tags. This satisfies zizmor's
unpinned-action-reference security check.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: oschwald

.github/workflows/codeql-analysis.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
         # We must fetch at least the immediate parents so that if this is
         # a pull request then we can checkout the head.
@@ -31,23 +31,23 @@ jobs:
       if: ${{ github.event_name == 'pull_request' }}
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5
+      uses: actions/setup-dotnet@2016bd2012dba4e32de620c46fe006a3ac9f0602 # v5.0.1
       with:
         dotnet-version: |
           8.0.x
           9.0.x
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
       # Override language selection by uncommenting this and choosing your languages
       # with:
       #   languages: go, javascript, csharp, python, cpp, java
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v4
+      uses: github/codeql-action/autobuild@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -61,4 +61,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9

.github/workflows/release.yml

@@ -16,13 +16,13 @@ jobs:
   build:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           submodules: true
           persist-credentials: false
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@2016bd2012dba4e32de620c46fe006a3ac9f0602 # v5.0.1
         with:
           dotnet-version: |
             8.0.x
@@ -41,7 +41,7 @@ jobs:
         run: dotnet pack -c Release MaxMind.GeoIP2/MaxMind.GeoIP2.csproj
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: nuget-packages
           path: MaxMind.GeoIP2/bin/Release/*.nupkg
@@ -55,7 +55,7 @@ jobs:
     if: github.event_name == 'release' && github.event.action == 'published'
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: nuget-packages
           path: packages

.github/workflows/test.yml

@@ -15,13 +15,13 @@ jobs:
     runs-on: ${{ matrix.platform }}
     name: Dotnet on ${{ matrix.platform }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           submodules: true
           persist-credentials: false
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@2016bd2012dba4e32de620c46fe006a3ac9f0602 # v5.0.1
         with:
           dotnet-version: |
             8.0.x

.github/workflows/zizmor.yml

@@ -15,7 +15,7 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
 

issue.md

@@ -0,0 +1,28 @@
+### Describe the bug
+
+After the recent GitHub Actions runner image update (win25/20251125.122), a test that uses WireMock.Net to return a simple `text/plain` response with HTTP 406 is now throwing `TaskCanceledException` on Windows with .NET 10.
+
+The same test passes on:
+- Windows with the previous image (win25/20251102.77)
+- Linux and macOS with the same .NET version
+- Windows with .NET 8 and .NET 9
+
+Failing build: https://github.com/maxmind/GeoIP2-dotnet/actions/runs/19903956765/job/57058325684
+
+### Expected behavior
+
+The test should receive the mocked HTTP 406 response and throw our custom `HttpException`, not a `TaskCanceledException`.
+
+### Test to reproduce
+
+1. Set up a WireMock server returning HTTP 406 with `Content-Type: text/plain`
+2. Make a synchronous HTTP request using `HttpClient.Send()` on .NET 10
+3. Run on Windows Server 2025 Build 7171
+
+Our test code: https://github.com/maxmind/GeoIP2-dotnet/blob/main/MaxMind.GeoIP2.UnitTests/WebServiceClientTests.cs#L146-L157
+
+### Other related info
+
+The main difference between the working and failing runner images is Windows OS Build 6905 → 7171. That update ([KB5068861](https://support.microsoft.com/en-us/topic/november-11-2025-kb5068861-os-build-26100-7171-24e553d1-2338-433e-9cc3-61733148530c)) mentions stricter HTTP.sys parsing for RFC 9112 compliance around CRLF in chunk extensions. Not sure if that's related, but thought it might be a lead.
+
+Using WireMock.Net 1.16.0.