From 4c018fe72c24211c88c2468965122f24e4baa382 Mon Sep 17 00:00:00 2001
From: Joshua <joshua.villaltaesp@gmail.com>
Date: Fri, 26 Jun 2026 15:06:41 +0100
Subject: [PATCH] feat: pinact workflows

---
 .github/workflows/bump-revengai-sdk.yaml |  6 +++---
 .github/workflows/features-drift.yml     |  4 ++--
 .github/workflows/publish.yaml           | 12 ++++++------
 .github/workflows/release.yaml           |  4 ++--
 4 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/bump-revengai-sdk.yaml b/.github/workflows/bump-revengai-sdk.yaml
index 975b9f1..c33276a 100644
--- a/.github/workflows/bump-revengai-sdk.yaml
+++ b/.github/workflows/bump-revengai-sdk.yaml
@@ -26,12 +26,12 @@ jobs:
           repositories: |
             plugin-binary-ninja
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           token: ${{ steps.generate-token.outputs.token }}
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.14'
 
@@ -77,7 +77,7 @@ jobs:
 
       - name: Open or update bump PR
         if: env.ABORT != 'true' && steps.bump.outputs.changed == 'true'
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
         with:
           token: ${{ steps.generate-token.outputs.token }}
           branch: ${{ env.BUMP_BRANCH }}
diff --git a/.github/workflows/features-drift.yml b/.github/workflows/features-drift.yml
index bf65e17..f4cf3f7 100644
--- a/.github/workflows/features-drift.yml
+++ b/.github/workflows/features-drift.yml
@@ -11,9 +11,9 @@ jobs:
   drift:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.10"
 
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 3c1aea2..59617d6 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -36,15 +36,15 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Set up Python ${{ matrix.python }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: ${{ matrix.python }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
 
       - name: Install build tools
         run: python -m pip install --upgrade pip setuptools wheel
@@ -86,7 +86,7 @@ jobs:
         shell: bash
 
       - name: Upload plugin artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: reveng_binary_ninja_plugin_${{ matrix.package-name }}
           path: dist/*.zip
@@ -98,7 +98,7 @@ jobs:
 
     steps:
       - name: Download built artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           path: dist
 
@@ -106,7 +106,7 @@ jobs:
         run: ls -R dist
 
       - name: Attach to published release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           tag_name: ${{ github.event.release.tag_name }}
           name: ${{ github.event.release.name }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index c727848..fc44136 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -14,7 +14,7 @@ jobs:
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
         with:
           app-id: ${{ secrets.REVENG_APP_ID }}
           private-key: ${{ secrets.REVENG_APP_PRIVATE_KEY }}
@@ -22,7 +22,7 @@ jobs:
           repositories: |
             plugin-binary-ninja
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
           token: ${{ steps.generate-token.outputs.token }}