From 52cf4701b964bab53a3835f47daa9ce9e9223924 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 08:56:43 +0000
Subject: [PATCH] chore(deps): pin dependencies

---
 .github/workflows/ci.yml                  | 6 +++---
 .github/workflows/label-sync.yml          | 6 +++---
 .github/workflows/project-board-admin.yml | 2 +-
 .github/workflows/project-board.yml       | 2 +-
 .github/workflows/release.yml             | 4 ++--
 5 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3cffb93..8012d5a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,7 +26,7 @@ jobs:
     name: Actionlint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install actionlint
         env:
@@ -45,7 +45,7 @@ jobs:
     name: YAML Validity
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install YAML parser
         run: |
@@ -92,6 +92,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Verify all gating jobs succeeded
-        uses: re-actors/alls-green@release/v1
+        uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # release/v1
         with:
           jobs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/label-sync.yml b/.github/workflows/label-sync.yml
index ea3cd6e..cfc542a 100644
--- a/.github/workflows/label-sync.yml
+++ b/.github/workflows/label-sync.yml
@@ -31,7 +31,7 @@ jobs:
     steps:
       - name: 'Mint org app token'
         id: 'app-token'
-        uses: 'actions/create-github-app-token@v3'
+        uses: 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1' # v3.2.0
         with:
           app-id: '${{ secrets.RELEASE_APP_ID }}'
           private-key: '${{ secrets.RELEASE_APP_PRIVATE_KEY }}'
@@ -65,13 +65,13 @@ jobs:
         repo: ${{ fromJSON(needs.discover.outputs.repos) }}
     steps:
       - name: 'Checkout label source'
-        uses: 'actions/checkout@v7'
+        uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1
         with:
           sparse-checkout: 'labels.yml'
 
       - name: 'Mint repo app token'
         id: 'app-token'
-        uses: 'actions/create-github-app-token@v3'
+        uses: 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1' # v3.2.0
         with:
           app-id: '${{ secrets.RELEASE_APP_ID }}'
           private-key: '${{ secrets.RELEASE_APP_PRIVATE_KEY }}'
diff --git a/.github/workflows/project-board-admin.yml b/.github/workflows/project-board-admin.yml
index 5904d1e..1547aa2 100644
--- a/.github/workflows/project-board-admin.yml
+++ b/.github/workflows/project-board-admin.yml
@@ -29,7 +29,7 @@ jobs:
       - name: 'Mint org-scoped App token'
         id: 'app-token'
         continue-on-error: true
-        uses: 'actions/create-github-app-token@v3'
+        uses: 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1' # v3.2.0
         with:
           app-id: '${{ secrets.ORG_AUTOMATION_APP_ID }}'
           private-key: '${{ secrets.ORG_AUTOMATION_APP_PRIVATE_KEY }}'
diff --git a/.github/workflows/project-board.yml b/.github/workflows/project-board.yml
index 87863ee..eba9f1d 100644
--- a/.github/workflows/project-board.yml
+++ b/.github/workflows/project-board.yml
@@ -45,7 +45,7 @@ jobs:
     steps:
       - name: 'Mint org-scoped Project token'
         id: 'app-token'
-        uses: 'actions/create-github-app-token@v3'
+        uses: 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1' # v3.2.0
         with:
           app-id: '${{ secrets.RELEASE_APP_ID }}'
           private-key: '${{ secrets.RELEASE_APP_PRIVATE_KEY }}'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 36d23f5..ab69e15 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,14 +15,14 @@ jobs:
       release_created: ${{ steps.rp.outputs.release_created }}
       tag_name: ${{ steps.rp.outputs.tag_name }}
     steps:
-      - uses: actions/create-github-app-token@v3
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: app-token
         continue-on-error: true
         with:
           app-id: ${{ secrets.RELEASE_APP_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
 
-      - uses: googleapis/release-please-action@v5
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         id: rp
         with:
           token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}