From 554213d1ed6a8c3bd4abdcce5117cd6fc91c07c8 Mon Sep 17 00:00:00 2001
From: Project516 <138796702+Project516@users.noreply.github.com>
Date: Wed, 26 Aug 2026 10:18:02 -0500
Subject: [PATCH] Pin wrapped actions by SHA

subosito/flutter-action@v2 and actions/cache@v6 are floating tags:
anyone consuming Project516/setup-flutter@v1 runs whatever those tags
point at the day their job starts, and this is published on the
Marketplace.

Pin both to full commit SHAs with the version in a trailing comment,
the shape Renovate updates:

  subosito/flutter-action@1a449444c3... # v2.23.0
  actions/cache@55cc8345863... # v6.1.0

Both SHAs verified against the tag refs via the GitHub API.
---
 action.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/action.yml b/action.yml
index 0e68477..4c64767 100644
--- a/action.yml
+++ b/action.yml
@@ -18,7 +18,7 @@ runs:
   using: composite
   steps:
     - name: Install Flutter
-      uses: subosito/flutter-action@v2
+      uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
       with:
         flutter-version: ${{ inputs.flutter-version }}
         channel: ${{ inputs.channel }}
@@ -26,7 +26,7 @@ runs:
         cache-key: flutter-${{ runner.os }}-${{ hashFiles('pubspec.yaml') }}
 
     - name: Cache pub
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         # subosito/flutter-action@v2 exports PUB_CACHE to the job environment,
         # pointing at the directory `flutter pub get` actually populates