From 5d028241923e6f8e950c6df8748a5297a415e356 Mon Sep 17 00:00:00 2001
From: "wandb-renovate[bot]"
 <285832833+wandb-renovate[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 06:54:52 +0000
Subject: [PATCH] chore(deps): pin actions/checkout action to 3d3c42e

---
 .github/workflows/docengine-bootstrap-selftest.yaml | 4 ++--
 .github/workflows/docengine-pin-guard-pr.yaml       | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/docengine-bootstrap-selftest.yaml b/.github/workflows/docengine-bootstrap-selftest.yaml
index e00af10ccd..dab712668f 100644
--- a/.github/workflows/docengine-bootstrap-selftest.yaml
+++ b/.github/workflows/docengine-bootstrap-selftest.yaml
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Bootstrap
         id: boot
@@ -82,7 +82,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Bootstrap with no token
         id: boot
diff --git a/.github/workflows/docengine-pin-guard-pr.yaml b/.github/workflows/docengine-pin-guard-pr.yaml
index 2875788cc6..4c79c1a283 100644
--- a/.github/workflows/docengine-pin-guard-pr.yaml
+++ b/.github/workflows/docengine-pin-guard-pr.yaml
@@ -107,7 +107,7 @@ jobs:
       ENGINE_REPO: coreweave/docengine
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         # No submodules and no token here on purpose. Reading which commit is
         # recorded needs nothing more than this repository's own files; only the
         # tag lookup further down needs credentials.