From e0f676056ee6805cd8a0bfbdd5fe6c9f33bda176 Mon Sep 17 00:00:00 2001
From: erwan-joly <erwan.joly+pro@gmail.com>
Date: Thu, 10 Sep 2026 23:41:51 +1200
Subject: [PATCH] chore: pin third-party actions to commit SHAs

Tags are mutable, so a moved tag silently changes what runs in CI. The
version each SHA came from is kept as a trailing comment.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/dotnet.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index d9624bf..7a46669 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -62,7 +62,7 @@ jobs:
           echo "tag=ci-${DATE}-${SHORT}" >> "$GITHUB_OUTPUT"
 
       - name: Create rolling release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           tag_name: ${{ steps.ver.outputs.tag }}
           name: ${{ steps.ver.outputs.tag }}