From 23b608ec75df7d0b2825b4e9977d0440d9a30111 Mon Sep 17 00:00:00 2001
From: "netic-renovate[bot]"
 <207156494+netic-renovate[bot]@users.noreply.github.com>
Date: Tue, 20 Oct 2026 13:14:52 +0000
Subject: [PATCH] Pin dependencies

---
 .github/workflows/ci.yml      |  8 ++++----
 .github/workflows/release.yml | 10 +++++-----
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5b66979..da94031 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,12 +12,12 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: go.mod
-      - uses: extractions/setup-just@v4
-      - uses: golangci/golangci-lint-action@v9
+      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
         with:
           # renovate: datasource=github-releases depName=golangci/golangci-lint
           version: v2.15.0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e169ee2..76f50e3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,26 +11,26 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: go.mod
       - run: go test ./...
       # A short-lived token from the release app, limited to the tap, which
       # GITHUB_TOKEN can't reach.
       - id: tap-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         with:
           client-id: ${{ vars.TAP_APP_CLIENT_ID }}
           private-key: ${{ secrets.TAP_APP_PRIVATE_KEY }}
           owner: neticdk
           repositories: netic-homebrew-tap
-      - uses: goreleaser/goreleaser-action@v7
+      - uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7
         with:
           # renovate: datasource=github-releases depName=goreleaser/goreleaser
-          version: v2.18.2
+          version: v2.18.3
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}