From 7ee4699e0c3c2684b2db2ba95760891c2fac0ab5 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Tue, 8 Sep 2026 12:41:21 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/workflows/spm-release.yml    |  2 +-
 .github/workflows/test-embedding.yml | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/spm-release.yml b/.github/workflows/spm-release.yml
index 306dc5f03..1782d3229 100644
--- a/.github/workflows/spm-release.yml
+++ b/.github/workflows/spm-release.yml
@@ -75,7 +75,7 @@ jobs:
 
       - name: Checkout the release tag
         if: ${{ steps.ver.outputs.skip != 'true' }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ steps.ver.outputs.tag }}
           fetch-depth: 0
diff --git a/.github/workflows/test-embedding.yml b/.github/workflows/test-embedding.yml
index 0565a1c86..83ce29f3f 100644
--- a/.github/workflows/test-embedding.yml
+++ b/.github/workflows/test-embedding.yml
@@ -44,7 +44,7 @@ jobs:
           preload-curl: OFF
           preload-storage: OFF
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Install system dependencies
       if: matrix.dependencies == 'system'
       run: sudo apt-get update && sudo apt-get install -y libcurl4-openssl-dev libsqlite3-dev ninja-build zlib1g-dev
@@ -83,7 +83,7 @@ jobs:
   windows:
     runs-on: windows-2022
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Configure
       run: >
         cmake -S tests/embedding -B build-embedding -A x64
@@ -102,7 +102,7 @@ jobs:
       matrix:
         mode: [system, fetched]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Install system dependencies
       if: matrix.mode == 'system'
       run: sudo apt-get update && sudo apt-get install -y libcurl4-openssl-dev libsqlite3-dev zlib1g-dev
@@ -147,7 +147,7 @@ jobs:
   installed-package-macos:
     runs-on: macos-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Configure, install, and consume
       run: |
         cmake -G Ninja -S . -B build-package \
@@ -175,7 +175,7 @@ jobs:
       matrix:
         architectures: [arm64, "arm64;x86_64"]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Configure
       run: >
         cmake -G Ninja -S tests/embedding -B build-embedding
@@ -199,7 +199,7 @@ jobs:
           sqlite-provider: VENDORED
           zlib-provider: VENDORED
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Configure
       run: >
         cmake -G Xcode -S tests/embedding -B build-embedding
@@ -218,7 +218,7 @@ jobs:
   android:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Configure
       run: >
         cmake -G Ninja -S tests/embedding -B build-embedding