From e6bd1951d4695409509d957036fa667dfe2618eb Mon Sep 17 00:00:00 2001
From: Riccardo Sarro <rsar@bendingspoons.com>
Date: Mon, 22 Jun 2026 12:04:30 +0200
Subject: [PATCH] fix: pin GitHub Actions to SHA for supply chain security

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
---
 .github/workflows/go.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index c3c3206..b2cf84f 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -10,13 +10,13 @@ jobs:
         goversion: ["1.24", "1.25"]
     steps:
       - name: Set up Go ${{matrix.goversion}} on ${{matrix.os}}
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: ${{matrix.goversion}}
         id: go
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: gofmt
         run: |