From 16221205c7149802e43f11376e0d83477b7ce9dd Mon Sep 17 00:00:00 2001
From: Ory Medina <ory.medinaceja@tollbit.com>
Date: Tue, 21 Jul 2026 13:02:24 -0600
Subject: [PATCH] [SECURITY] Fix GH action SHAs

---
 .github/workflows/ci.yml      |  4 ++--
 .github/workflows/release.yml | 10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a2205e5..d70f09b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,10 +25,10 @@ jobs:
         tags: ["", "dev"]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f3ad4fb..0bc0ebe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
@@ -36,13 +36,13 @@ jobs:
           echo "ok: tag ${GITHUB_REF_NAME} matches version.go (${CODE})"
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
 
       # Publishes GitHub Releases on this repo (tollbit/cli).
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         with:
           distribution: goreleaser
           version: "~> v2"
@@ -58,13 +58,13 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # Node 24 ships npm >= 11.5.1, required for Trusted Publishing (OIDC).
       # Do not set registry-url: setup-node would write an empty _authToken line
       # that short-circuits OIDC and surfaces as a misleading E404 on publish.
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "24"