From 656f661595ecd149d344bc742d3be611185ad3ef Mon Sep 17 00:00:00 2001
From: picatz <14850816+picatz@users.noreply.github.com>
Date: Thu, 11 Jun 2026 13:34:59 -0400
Subject: [PATCH] VLN-1429: fix unpinned-github-actions

---
 .github/workflows/build.yaml      | 6 +++---
 .github/workflows/push-to-buf.yml | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 46cac79..11c5f3c 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -6,13 +6,13 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0
         with:
           go-version: '1.21'
           check-latest: true
       - name: Install Protoc
-        uses: arduino/setup-protoc@v2
+        uses: arduino/setup-protoc@a8b67ba40b37d35169e222f3bb352603327985b6 # v2.1.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Validate and build go bindings from the proto files
diff --git a/.github/workflows/push-to-buf.yml b/.github/workflows/push-to-buf.yml
index 6bc3d4c..f2cd0a6 100644
--- a/.github/workflows/push-to-buf.yml
+++ b/.github/workflows/push-to-buf.yml
@@ -13,8 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
-      - uses: bufbuild/buf-action@v1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: bufbuild/buf-action@fd21066df7214747548607aaa45548ba2b9bc1ff # v1.4.0
         with:
           version: 1.49.0
           token: ${{ secrets.BUF_TEMPORALIO_TOKEN }}