From 53ccd9f7ca56a77c445c1cf5eada3ea8e07c16b6 Mon Sep 17 00:00:00 2001
From: Trung Lê <8@tle.id.au>
Date: Wed, 10 Jun 2026 11:11:08 +1000
Subject: ci: pin GitHub Actions to commit SHAs (checkout v6.0.3, codeql-action
 v4.36.2)

---
 .github/workflows/gobject-linter.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/gobject-linter.yml b/.github/workflows/gobject-linter.yml
index 403871f..42b72da 100644
--- a/.github/workflows/gobject-linter.yml
+++ b/.github/workflows/gobject-linter.yml
@@ -23,7 +23,7 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       # Produce SARIF for the Security tab and inline PR annotations.
       # Never fails the job — the blocking gate below decides pass/fail.
@@ -31,7 +31,7 @@ jobs:
         run: gobject-linter . --format sarif > gobject-linter.sarif || true
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         # Pull requests from forks get a read-only token and cannot upload to
         # code scanning; don't let that fail the run.
         continue-on-error: true
-- 
cgit v1.2.3