From d2400b4b3808d8c31f5566013862917810386fc8 Mon Sep 17 00:00:00 2001
From: mirkosalvato1-ctrl
 <227404546+mirkosalvato1-ctrl@users.noreply.github.com>
Date: Thu, 23 Jul 2026 10:26:38 +0200
Subject: [PATCH] ci: pin GitHub Actions to commit SHAs (4 pin(s))

---
 .github/workflows/ci-tests-connectors.yml | 4 ++--
 .github/workflows/ci-unused-deps.yml      | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci-tests-connectors.yml b/.github/workflows/ci-tests-connectors.yml
index b9494c39fd3..194073595fa 100644
--- a/.github/workflows/ci-tests-connectors.yml
+++ b/.github/workflows/ci-tests-connectors.yml
@@ -111,7 +111,7 @@ jobs:
 
       - name: Upload coverage to Codecov
         if: ${{ !cancelled() && github.event_name == 'pull_request' && hashFiles('coverage.xml') != '' }}
-        uses: codecov/codecov-action@v7
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage.xml
@@ -121,7 +121,7 @@ jobs:
 
       - name: Upload test results to Codecov
         if: ${{ !cancelled() && github.event_name == 'pull_request' }}
-        uses: codecov/codecov-action@v7
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           report_type: test_results
diff --git a/.github/workflows/ci-unused-deps.yml b/.github/workflows/ci-unused-deps.yml
index 3a35a820ff1..1d53024c1dc 100644
--- a/.github/workflows/ci-unused-deps.yml
+++ b/.github/workflows/ci-unused-deps.yml
@@ -106,7 +106,7 @@ jobs:
 
       - name: Comment on PR
         if: steps.deptry.outputs.warnings != '' && github.event.pull_request.head.repo.full_name == github.repository
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b  # v7
         with:
           script: |
             const marker = '<!-- unused-deps-bot -->';
@@ -140,7 +140,7 @@ jobs:
 
       - name: Remove comment if no warnings
         if: steps.deptry.outputs.warnings == '' && github.event.pull_request.head.repo.full_name == github.repository
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b  # v7
         with:
           script: |
             const marker = '<!-- unused-deps-bot -->';