From d6fde2509b08c1d08aabd32694e183cb3c51e319 Mon Sep 17 00:00:00 2001
From: Mahangu Weerasinghe <mahangu@automattic.com>
Date: Mon, 22 Jun 2026 17:01:47 +0530
Subject: [PATCH] chore: pin third-party GitHub Actions to commit SHAs

---
 .github/workflows/php-transformer.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/php-transformer.yml b/.github/workflows/php-transformer.yml
index 2ca50c5..f17eaae 100644
--- a/.github/workflows/php-transformer.yml
+++ b/.github/workflows/php-transformer.yml
@@ -26,7 +26,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240  # 2.37.2
         with:
           php-version: "8.1"
           coverage: none