From eb2efaa7175195fa8f255e23f15c5c8e5c09106a Mon Sep 17 00:00:00 2001
From: Quentin Laplanche <quentin.laplanche@docker.com>
Date: Mon, 20 Apr 2026 11:44:51 +0200
Subject: [PATCH] chore: pin GitHub Actions to commit SHA -e Signed-off-by:
 Quentin Laplanche <quentin.laplanche@docker.com>

---
 .github/workflows/release-branch.yml | 6 +++---
 .github/workflows/release.yml        | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release-branch.yml b/.github/workflows/release-branch.yml
index 5818871f..f2e1c31e 100644
--- a/.github/workflows/release-branch.yml
+++ b/.github/workflows/release-branch.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Hub Login
         uses: docker/login-action@v2
         with:
@@ -53,11 +53,11 @@ jobs:
     needs: test
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
       - name: Tag name
-        uses: mad9000/actions-find-and-replace-string@2
+        uses: mad9000/actions-find-and-replace-string@bf97a127285f67d542d3f06145424c64803ae81a # 2
         id: tagname
         with:
           source: ${{ github.head_ref }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 565fef61..8e0ce11e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,12 +21,12 @@ jobs:
       RELEASE_REF: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }}
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
           ref: ${{ env.RELEASE_REF }}
       - name: Create Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
         with:
           draft: true
           tag_name: ${{ env.RELEASE_REF }}