From c8c7554f354bc21c521e136a682f39a5782c27d2 Mon Sep 17 00:00:00 2001
From: slackstat <263442225+slackstat@users.noreply.github.com>
Date: Mon, 23 Feb 2026 10:55:10 -0800
Subject: [PATCH] security: pin GitHub Actions to commit SHAs

---
 .github/workflows/release.yml | 4 ++--
 .github/workflows/test.yml    | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1237996..4d34717 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,7 +11,7 @@ jobs:
   build:
     runs-on: macos-15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Build release binary
         run: swift build -c release
@@ -63,7 +63,7 @@ jobs:
         run: zip -r SlackStat.zip SlackStat.app
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
         with:
           files: SlackStat.zip
           body: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0a9fec5..9e78c22 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -10,7 +10,7 @@ jobs:
   test:
     runs-on: macos-15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Build
         run: swift build