From b0b1d018c2748cec99ca8c02ec0d0f855114e9d7 Mon Sep 17 00:00:00 2001
From: rehan-fr <rehan.ullah@fresha.com>
Date: Tue, 28 Jul 2026 17:25:59 +0100
Subject: [PATCH 1/2] chore: replace runs-on/cache with the
 StepSecurity-maintained fork

5 refs in ci.yml (4x root cache, 1x cache/save) move to
step-security/runs-on-cache@c5b0cba1 # v5.0.7 - the sha the rest of the
org already pins. action.yml is byte-identical apart from author:, and
the RunsOn S3 backend (RUNS_ON_S3_BUCKET_CACHE) is preserved.
---
 .github/workflows/ci.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7d161d21a..96377d7b4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -62,7 +62,7 @@ jobs:
           echo "HASH=$HASH" >> $GITHUB_OUTPUT
       - name: Hex auth
         run: mix hex.organization auth fresha --key ${{ secrets.HEX_ORGANIZATION_WRITE_KEY }}
-      - uses: runs-on/cache@a5f51d6f3fece787d03b7b4e981c82538a0654ed # v4
+      - uses: step-security/runs-on-cache@c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73 # v5.0.7
         id: deps-cache
         with:
           path: |
@@ -77,7 +77,7 @@ jobs:
           echo "Installing dependencies"
           mix deps.get
           mix deps.compile
-      - uses: runs-on/cache@a5f51d6f3fece787d03b7b4e981c82538a0654ed # v4
+      - uses: step-security/runs-on-cache@c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73 # v5.0.7
         id: build-cache
         with:
           path: '**/*'
@@ -131,7 +131,7 @@ jobs:
           echo "HASH=$HASH" >> $GITHUB_OUTPUT
       - name: Hex auth
         run: mix hex.organization auth fresha --key ${{ secrets.HEX_ORGANIZATION_WRITE_KEY }}
-      - uses: runs-on/cache@a5f51d6f3fece787d03b7b4e981c82538a0654ed # v4
+      - uses: step-security/runs-on-cache@c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73 # v5.0.7
         id: deps-cache
         with:
           path: |
@@ -146,7 +146,7 @@ jobs:
           echo "Installing dependencies"
           mix deps.get
           mix deps.compile
-      - uses: runs-on/cache@a5f51d6f3fece787d03b7b4e981c82538a0654ed # v4
+      - uses: step-security/runs-on-cache@c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73 # v5.0.7
         id: build-cache
         with:
           path: '**/*'
@@ -207,7 +207,7 @@ jobs:
           echo ""
           echo "==============================================="
       - name: Cache Approval File
-        uses: runs-on/cache/save@a5f51d6f3fece787d03b7b4e981c82538a0654ed # v4
+        uses: step-security/runs-on-cache/save@c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73 # v5.0.7
         with:
           path: approval.txt
           key: ${{ runner.os }}-${{ env.REPOSITORY }}-approval-${{ needs.static.outputs.HASH }}

From 4f2d388405ec1b9786a5f5cb18d0eab95bb5d761 Mon Sep 17 00:00:00 2001
From: rehan-fr <rehan.ullah@fresha.com>
Date: Tue, 28 Jul 2026 17:26:00 +0100
Subject: [PATCH 2/2] chore: replace runs-on/cache/restore with the
 StepSecurity-maintained fork

---
 .github/workflows/dev-publish.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dev-publish.yaml b/.github/workflows/dev-publish.yaml
index cdd61fe24..9e896605e 100644
--- a/.github/workflows/dev-publish.yaml
+++ b/.github/workflows/dev-publish.yaml
@@ -42,7 +42,7 @@ jobs:
           echo "APPROVAL PRODUCED BY SUCCESSFULL CHECKS EXECUTION WILL LAND IN CACHE"
           echo "HASH=$HASH" >> $GITHUB_OUTPUT
       - name: Check for CI successes
-        uses: runs-on/cache/restore@a5f51d6f3fece787d03b7b4e981c82538a0654ed # v4
+        uses: step-security/runs-on-cache/restore@c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73 # v5.0.7
         with:
           key: ${{ runner.os }}-${{ env.REPOSITORY }}-approval-${{ steps.hash.outputs.HASH }}
           path: approval.txt