From db2678f816251d4014ed130a57c203f0ac02b6a7 Mon Sep 17 00:00:00 2001
From: "semgrep-zcs-prod-semgrep[bot]"
 <158082902+semgrep-zcs-prod-semgrep[bot]@users.noreply.github.com>
Date: Tue, 28 Jul 2026 23:07:33 +0000
Subject: [PATCH] Pin GitHub Actions to commit SHAs

---
 .github/workflows/require-version-label.yml | 2 +-
 .github/workflows/version-bump.yml          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/require-version-label.yml b/.github/workflows/require-version-label.yml
index ae8b784..c767ad5 100644
--- a/.github/workflows/require-version-label.yml
+++ b/.github/workflows/require-version-label.yml
@@ -11,7 +11,7 @@ jobs:
     outputs:
       has_plugin_changes: ${{ steps.check.outputs.has_changes }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/version-bump.yml b/.github/workflows/version-bump.yml
index 04a37dd..d37606f 100644
--- a/.github/workflows/version-bump.yml
+++ b/.github/workflows/version-bump.yml
@@ -10,7 +10,7 @@ jobs:
     if: startsWith(github.event.label.name, 'bump:')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           ref: ${{ github.head_ref }}