Pin github actions to commit SHAs

This reduces the attack surface of supply-chain attacks and is generally a good practice.
2026-09-27 10:53:50 +02:00 · 2025-09-17 11:55:41 +02:00
parent f13941d350
commit 32b3007a3f
3 changed files with 7 additions and 7 deletions
@@ -10,10 +10,10 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0

      - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
          cache: 'npm'