From 6322bbce1997d786dc316ae0c228915b0a836ce7 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 28 May 2026 21:42:25 +0000
Subject: [PATCH] chore(deps): pin dependencies

---
 .github/actions/dotnet-test/action.yml               | 2 +-
 .github/workflows/workflow-common-release-sslcom.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/actions/dotnet-test/action.yml b/.github/actions/dotnet-test/action.yml
index 31ead7b..baf6d8a 100644
--- a/.github/actions/dotnet-test/action.yml
+++ b/.github/actions/dotnet-test/action.yml
@@ -131,7 +131,7 @@ runs:
 
     - name: Run tests with legacy Coverlet MSBuild coverage
       if: steps.detect-mode.outputs.mode == 'legacy'
-      uses: glennawatson/coverlet-msbuild@v2.1
+      uses: glennawatson/coverlet-msbuild@9a6e0593934168bec404ee30f395336d4fccc303 # v2.1
       with:
         project-files: '${{ inputs.src-folder }}/${{ inputs.tests-project-glob }}'
         no-build: true
diff --git a/.github/workflows/workflow-common-release-sslcom.yml b/.github/workflows/workflow-common-release-sslcom.yml
index 131eef6..e37b707 100644
--- a/.github/workflows/workflow-common-release-sslcom.yml
+++ b/.github/workflows/workflow-common-release-sslcom.yml
@@ -133,7 +133,7 @@ jobs:
         run: dotnet pack --no-restore --configuration ${{ inputs.configuration }} ${{ inputs.solutionFile }} -o "${GITHUB_WORKSPACE}/packages"
 
       - name: Sign packages with SSL.com eSigner
-        uses: SSLcom/esigner-codesign@v1.3.2
+        uses: SSLcom/esigner-codesign@cf5f6c1d38ad10f47e3ed9aca873f429b1a8d85b # v1.3.2
         with:
           command: batch_sign
           username: ${{ secrets.ES_USERNAME }}