From f14d993946154ba195c65823ca361d2873a7e665 Mon Sep 17 00:00:00 2001
From: Mattias Kindborg <mattias.kindborg@axis.com>
Date: Tue, 18 Aug 2026 18:03:41 +0200
Subject: [PATCH] ci: pin GitHub Actions to commit SHAs

---
 .github/workflows/publish.yml | 6 +++---
 .github/workflows/verify.yml  | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index cc673b1..5ea6214 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -13,12 +13,12 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
         with:
           fetch-depth: 0
 
       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: '18'
           registry-url: 'https://registry.npmjs.org'
@@ -39,7 +39,7 @@ jobs:
 
       - name: Release
         id: release
-        uses: actions/create-release@v1
+        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 5b11979..e89fee8 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -18,12 +18,12 @@ jobs:
       matrix:
         node-version: ['16', '18']
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
         with:
           fetch-depth: 0
 
       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: ${{ matrix.node-version }}