From 26559b6d4767d405800d123f8259e7774e008c77 Mon Sep 17 00:00:00 2001
From: slawomirbabicz <111378977+slawomirbabicz@users.noreply.github.com>
Date: Thu, 9 Apr 2026 14:04:28 +0200
Subject: [PATCH 1/2] chore: pin actions to SHA in
 .github/workflows/backend.yml

---
 .github/workflows/backend.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/backend.yml b/.github/workflows/backend.yml
index e49772b..675c077 100644
--- a/.github/workflows/backend.yml
+++ b/.github/workflows/backend.yml
@@ -19,7 +19,7 @@ jobs:
     env:
       DFX_VERSION: 0.7.0-beta.6
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
     - name: Install
       run: |
         echo y | DFX_VERSION=$DFX_VERSION bash -ci "$(curl -fsSL https://sdk.dfinity.org/install.sh)"

From c3c3a9101e771282f7e57438ce6324c30afb1319 Mon Sep 17 00:00:00 2001
From: slawomirbabicz <111378977+slawomirbabicz@users.noreply.github.com>
Date: Thu, 9 Apr 2026 14:04:30 +0200
Subject: [PATCH 2/2] chore: pin actions to SHA in
 .github/workflows/build-and-test.yml

---
 .github/workflows/build-and-test.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index e4d446a..a4c8bfe 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -19,9 +19,9 @@ jobs:
     env:
       DFX_VERSION: 0.7.0-beta.6
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
     - name: Setup Node.js environment
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
       with:
         node-version: "12"
     - name: Install
@@ -59,14 +59,14 @@ jobs:
         dfx stop
 
     - name: Upload e2e videos artifact
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1
       if: failure()
       with:
         name: failed-e2e-files
         path: ~/work/cancan-archived/cancan-archived/e2e/cypress/videos/*.mp4
 
     - name: Upload failed files artifact
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1
       if: failure()
       with:
         name: fail-build