From 23ad96fe597fe7b605b55d9dd58ae1fb5fbe475e Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 22 May 2026 13:36:34 +0000
Subject: [PATCH] chore(deps): pin dependencies

---
 .github/workflows/docs-check.yml   | 14 +++++++-------
 .github/workflows/metrics.yml      |  8 ++++----
 .github/workflows/version-sync.yml |  6 +++---
 3 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/docs-check.yml b/.github/workflows/docs-check.yml
index ed36c77..58f0871 100644
--- a/.github/workflows/docs-check.yml
+++ b/.github/workflows/docs-check.yml
@@ -32,7 +32,7 @@ jobs:
     name: Markdown Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Ensure markdownlint config
         run: |
@@ -47,7 +47,7 @@ jobs:
       - name: Markdown Lint
         id: lint
         continue-on-error: true
-        uses: davidanson/markdownlint-cli2-action@v16
+        uses: davidanson/markdownlint-cli2-action@b4c9feab76d8025d1e83c653fa3990936df0e6c8 # v16
         with:
           globs: ${{ inputs.markdownlint-globs }}
 
@@ -72,13 +72,13 @@ jobs:
     if: ${{ !inputs.skip-vitepress }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 9
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
 
@@ -131,10 +131,10 @@ jobs:
     if: ${{ !inputs.skip-link-check }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Check local links
-        uses: lycheeverse/lychee-action@v2
+        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2
         with:
           args: >-
             --offline
diff --git a/.github/workflows/metrics.yml b/.github/workflows/metrics.yml
index a97d78b..9d25831 100644
--- a/.github/workflows/metrics.yml
+++ b/.github/workflows/metrics.yml
@@ -25,15 +25,15 @@ jobs:
     outputs:
       metrics_json_path: ${{ steps.synth.outputs.path }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
         with:
           toolchain: stable
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
       - name: Install tools
         run: |
@@ -80,7 +80,7 @@ jobs:
             }' > metrics/metrics.json
           echo "path=metrics/metrics.json" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: metrics-${{ github.event.repository.name }}-${{ github.run_number }}
           path: metrics/
diff --git a/.github/workflows/version-sync.yml b/.github/workflows/version-sync.yml
index b4006ea..3fb16b8 100644
--- a/.github/workflows/version-sync.yml
+++ b/.github/workflows/version-sync.yml
@@ -17,16 +17,16 @@ jobs:
   version-sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Checkout org .github
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           repository: anolishq/.github
           path: _github
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: ${{ inputs.python-version }}