From f8727b31448c9b305d6cc9e4c3040531013c1788 Mon Sep 17 00:00:00 2001
From: mirkosalvato1-ctrl
 <227404546+mirkosalvato1-ctrl@users.noreply.github.com>
Date: Thu, 23 Jul 2026 01:39:33 +0200
Subject: [PATCH] ci: pin GitHub Actions to commit SHAs (1 pin(s))

---
 .github/workflows/publish-pypi.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 2f2e895b..c9e5b6c3 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -47,7 +47,7 @@ jobs:
 
       - name: Resolve latest stagehand/server-v3 release
         id: stagehand-server-release
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410  # v6
         with:
           github-token: ${{ secrets.STAGEHAND_SOURCE_TOKEN || github.token }}
           script: |