From 6d3be2f647c4efceb2b122b6de95ef9c32cd21c9 Mon Sep 17 00:00:00 2001
From: Pierre-Louis Veyrenc <pierrelouis.veyrenc@datadoghq.com>
Date: Wed, 5 Aug 2026 16:01:24 +0200
Subject: [PATCH] [ACIX-1926] chore(ci): pin GitHub Actions to commit SHAs

Mechanical rewrite of every `uses:` reference to a full-length commit SHA, produced by [pinact](https://github.com/suzuki-shunsuke/pinact). An unpinned reference resolves to a mutable ref, so a compromise of the upstream action becomes code execution in this repository's CI.

The trailing `# vX.Y.Z` comment is what lets Renovate and Dependabot keep these bumped, so please keep it.

**One thing to check:** references that tracked `@main` or `@master` were resolved to the latest stable tag. If any of them floated deliberately and that behaviour was load-bearing here, say so on the PR and we will revert that line.
---
 .github/workflows/slapr.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/slapr.yml b/.github/workflows/slapr.yml
index b2975fc3..e5aab5c4 100644
--- a/.github/workflows/slapr.yml
+++ b/.github/workflows/slapr.yml
@@ -19,7 +19,7 @@ jobs:
         with:
           scope: DataDog/agent-linux-install-script
           policy: self.slapr.run-slapr
-      - uses: DataDog/slapr@4b5efe2ce585e45898bb88c4fa303e226e8199e4 # master
+      - uses: DataDog/slapr@4b5efe2ce585e45898bb88c4fa303e226e8199e4 # 1.0.0
         env:
           GITHUB_TOKEN: "${{ steps.octo-sts.outputs.token }}"
           SLACK_CHANNEL_ID: "${{ vars.SLACK_CHANNEL_ID }}"