From 272cc2cbd3f48ddbefc93d9ba1325cf54d0b9377 Mon Sep 17 00:00:00 2001
From: erwan-joly <erwan.joly+pro@gmail.com>
Date: Thu, 10 Sep 2026 23:41:21 +1200
Subject: [PATCH] chore: pin third-party actions to commit SHAs

Tags are mutable, so a moved tag silently changes what runs in CI. The
version each SHA came from is kept as a trailing comment.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/dotnet.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index a7c70f5..b17ea87 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -64,7 +64,7 @@ jobs:
 
     - name: Upload Release Asset
       if: steps.check-tag.outputs.match == 'true'
-      uses: softprops/action-gh-release@v3
+      uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
       with:
         files: ${{ steps.build_artifact.outputs.ARTIFACT_PATH }}
       env: