From e44cba79f846151749cd6acb7e4c36ea17dad418 Mon Sep 17 00:00:00 2001
From: "itv-github-actions-pinner[bot]"
 <291802493+itv-github-actions-pinner[bot]@users.noreply.github.com>
Date: Thu, 23 Jul 2026 18:26:00 +0100
Subject: [PATCH] fix(security): pin dependencies

---
 .github/workflows/build.yml         | 6 +++---
 .github/workflows/labeler.yml       | 2 +-
 .github/workflows/release.yml       | 8 ++++----
 .github/workflows/scala-steward.yml | 4 ++--
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index af12db9e..afdaf968 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -11,13 +11,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
       - name: Set up JDK 1.8
-        uses: actions/setup-java@v1
+        uses: actions/setup-java@b6e674f4b717d7b0ae3baee0fbe79f498905dfde # v1
         with:
           java-version: 1.8
       - name: Cache sbt
-        uses: actions/cache@v2
+        uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
         with:
           path: |
             ~/.sbt
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index aa7c6510..9c5f4078 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -8,7 +8,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Label the PR action
-        uses: TimonVS/pr-labeler-action@v3
+        uses: TimonVS/pr-labeler-action@bd0b592a410983316a454e3d48444608f028ec8e # v3
         with:
           configuration-path: .github/labeler.yml
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 64f32d3f..d26a5209 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,15 +10,15 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
         with:
           fetch-depth: 0
       - name: Set up JDK 1.8
-        uses: actions/setup-java@v1
+        uses: actions/setup-java@b6e674f4b717d7b0ae3baee0fbe79f498905dfde # v1
         with:
           java-version: 1.8
       - name: Cache sbt
-        uses: actions/cache@v2
+        uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
         with:
           path: |
             ~/.sbt
@@ -29,7 +29,7 @@ jobs:
       - name: Extract latest version
         run: echo "VERSION=`echo $(git describe --tags --abbrev=0)`" >> $GITHUB_ENV
       - name: Publish release notes
-        uses: release-drafter/release-drafter@v5
+        uses: release-drafter/release-drafter@09c613e259eb8d4e7c81c2cb00618eb5fc4575a7 # v5
         with:
           config-name: release-drafter.yml
           publish: true
diff --git a/.github/workflows/scala-steward.yml b/.github/workflows/scala-steward.yml
index 7afade99..53a7e8ae 100644
--- a/.github/workflows/scala-steward.yml
+++ b/.github/workflows/scala-steward.yml
@@ -10,9 +10,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
       - name: Execute Scala Steward
-        uses: scala-steward-org/scala-steward-action@v2
+        uses: scala-steward-org/scala-steward-action@ff09222640622d474d0d9f93c04aefedd125b187 # v2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           author-email: scala-steward@users.noreply.github.com