From 7a523bd3117d8b80c9dd1cf533bfebddb3227d62 Mon Sep 17 00:00:00 2001
From: Riccardo Sarro <rsar@bendingspoons.com>
Date: Mon, 22 Jun 2026 12:03:59 +0200
Subject: [PATCH] fix: pin GitHub Actions to SHA for supply chain security

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
---
 .github/workflows/go.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 0873ac1..e81e5b9 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -12,13 +12,13 @@ jobs:
     steps:
 
     - name: Set up Go ${{matrix.goversion}} on ${{matrix.os}}
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
       with:
         go-version: ${{matrix.goversion}}
       id: go
 
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
     
     - name: gofmt
       run: |