From ba72449677a2e36137c0951e7bcea9ffa7d60d77 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 21 May 2026 08:33:15 +0000
Subject: [PATCH] [TASK] Pin dependencies

---
 .github/workflows/release.yaml | 6 +++---
 .github/workflows/tests.yaml   | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 393b550..cb91eee 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -40,7 +40,7 @@ jobs:
           php ~/.composer/vendor/bin/tailor create-artefact "${{ github.ref_name }}"
 
       - name: Upload extension artefact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: extension-artefact
           path: tailor-version-artefact/${{ env.EXTENSION_ARTEFACT }}
@@ -56,7 +56,7 @@ jobs:
 
       - name: Download extension artefact
         id: download
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: extension-artefact
 
@@ -79,7 +79,7 @@ jobs:
 
       - name: Download extension artefact
         id: download
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: extension-artefact
 
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index baa3414..32f20b8 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -88,7 +88,7 @@ jobs:
         working-directory: .Build/coverage
         run: sed -i 's#/home/runner/work/handlebars-forms/handlebars-forms#${{ github.workspace }}#g' clover.xml
       - name: Upload coverage artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: coverage
           path: .Build/coverage/clover.xml
@@ -106,7 +106,7 @@ jobs:
       # Download artifact
       - name: Download coverage artifact
         id: download
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: coverage