From 1fdd97f6b6b8db53bec8d5adf36a3eba1434d9f3 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 19 Jun 2026 17:49:51 +0000
Subject: [PATCH] Pin dependencies

---
 .github/workflows/release.yaml      |  4 ++--
 .github/workflows/test-release.yaml | 12 ++++++------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 917eaca..ea0b9f4 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -15,14 +15,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Build the dist
         run: make all
         if: startsWith(github.ref, 'refs/tags/')
 
       - name: Release GHA
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
         if: startsWith(github.ref, 'refs/tags/')
         with:
           generate_release_notes: true
diff --git a/.github/workflows/test-release.yaml b/.github/workflows/test-release.yaml
index 61df765..de127cf 100644
--- a/.github/workflows/test-release.yaml
+++ b/.github/workflows/test-release.yaml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Wait for release
-        uses: lewagon/wait-on-check-action@v1.7.0
+        uses: lewagon/wait-on-check-action@96d9100b431964d10e0136aff8b9ccb92470505e # v1.8.0
         with:
           ref: ${{ github.ref }}
           check-name: "Release GHA"
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: wait-for-release
     steps:
-      - uses: releasetools/cli@v0
+      - uses: releasetools/cli@964f2bb77ea50d9c1c9aa70e9cb2e7c19212c8a6 # v0
       - name: Run tests
         shell: bash
         run: |
@@ -47,7 +47,7 @@ jobs:
             echo "No matching version found" >&2
             exit 1
           fi
-      - uses: releasetools/cli@v0
+      - uses: releasetools/cli@964f2bb77ea50d9c1c9aa70e9cb2e7c19212c8a6 # v0
         with:
           version: ${{ env.VERSION }}
       - name: Run Tests
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: wait-for-release
     steps:
-      - uses: releasetools/cli@v0
+      - uses: releasetools/cli@964f2bb77ea50d9c1c9aa70e9cb2e7c19212c8a6 # v0
         env:
           RELEASETOOLS_INSTALL_DIR: /opt/hostedtoolcache/releasetools
           RELEASETOOLS_BINARY_DIR: ${{ runner.temp }}/bin
@@ -97,7 +97,7 @@ jobs:
         run: |
           bash <(curl -sSL "https://github.com/releasetools/cli/releases/download/${{ env.VERSION }}/install.sh")
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Install release tools dependencies
         run: |
@@ -135,7 +135,7 @@ jobs:
             echo "No matching version found" >&2
             exit 1
           fi
-      - uses: releasetools/cli@v0
+      - uses: releasetools/cli@964f2bb77ea50d9c1c9aa70e9cb2e7c19212c8a6 # v0
         with:
           version: ${{ env.VERSION }}
       - name: Run tests