From 2d4eef48b0ff171995b3f98b5bc7e072b5985002 Mon Sep 17 00:00:00 2001
From: Mahangu Weerasinghe <mahangu@gmail.com>
Date: Sun, 31 May 2026 15:58:45 +0530
Subject: [PATCH] chore: pin third-party GitHub Actions to SHAs + enable
 Dependabot

Hardens against supply-chain risk on mutable tags. Dependabot keeps
the pinned SHAs fresh weekly, with major bumps held under cooldown.

Tracking: DEVPROD-1072
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b83c4a4..7f839ae 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
     name: OTP ${{matrix.otp}} / Elixir ${{matrix.elixir}}
     steps:
       - uses: actions/checkout@v4
-      - uses: erlef/setup-beam@v1
+      - uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0
         with:
           otp-version: ${{matrix.otp}}
           elixir-version: ${{matrix.elixir}}