From 413d576831c49ff073612236cfc08dd62a0a8fdd Mon Sep 17 00:00:00 2001
From: Alex Baker <alexander_j_baker@apple.com>
Date: Fri, 12 Jun 2026 17:12:29 -0700
Subject: [PATCH] Move to commit SHAs for .github/workflows actions

---
 .github/workflows/ci-prb.yml          | 4 ++--
 .github/workflows/ci-release-docs.yml | 8 ++++----
 .github/workflows/ci-release.yml      | 6 +++---
 .github/workflows/ci-snapshot.yml     | 8 ++++----
 4 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/ci-prb.yml b/.github/workflows/ci-prb.yml
index 832b5428..78842084 100644
--- a/.github/workflows/ci-prb.yml
+++ b/.github/workflows/ci-prb.yml
@@ -16,9 +16,9 @@ jobs:
         os: [ ubuntu-latest ]
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Set up Python ${{ matrix.python }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python }}
       - name: Install dependencies
diff --git a/.github/workflows/ci-release-docs.yml b/.github/workflows/ci-release-docs.yml
index 332219e3..8125aa6a 100644
--- a/.github/workflows/ci-release-docs.yml
+++ b/.github/workflows/ci-release-docs.yml
@@ -9,9 +9,9 @@ jobs:
     name: Python Doc Builder
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: "3.14"
     - name: Install dependencies
@@ -24,7 +24,7 @@ jobs:
     - name: Spinx build
       run: sphinx-build -b html _staging _build
     - name: Upload docs
-      uses: actions/upload-pages-artifact@v5
+      uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
       with:
         path: _build
   deploy:
@@ -40,4 +40,4 @@ jobs:
     steps:
       - name: Deploy
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
diff --git a/.github/workflows/ci-release.yml b/.github/workflows/ci-release.yml
index 649a8b36..8fe60a00 100644
--- a/.github/workflows/ci-release.yml
+++ b/.github/workflows/ci-release.yml
@@ -14,9 +14,9 @@ jobs:
     permissions:
       id-token: write
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: "3.14"
     - name: Install build
@@ -30,4 +30,4 @@ jobs:
         python3 -m
         build
     - name: Publish to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
diff --git a/.github/workflows/ci-snapshot.yml b/.github/workflows/ci-snapshot.yml
index 632c5bfc..5e7a68a2 100644
--- a/.github/workflows/ci-snapshot.yml
+++ b/.github/workflows/ci-snapshot.yml
@@ -11,9 +11,9 @@ jobs:
     name: Python Snapshot Builder
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: "3.14"
     - name: Install build
@@ -27,7 +27,7 @@ jobs:
         python3 -m
         build
     - name: Publish to Test PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
       with:
         password: ${{ secrets.TEST_PYPI_API_TOKEN }}
-        repository-url: https://test.pypi.org/legacy/
\ No newline at end of file
+        repository-url: https://test.pypi.org/legacy/