Pin third-party actions to a full length commit SHA

rezoleo · Jul 15, 2023 · 4972d6d · 4972d6d
1 parent 3cff689
commit 4972d6d
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/.github/workflows/build-latex.yaml b/.github/workflows/build-latex.yaml
@@ -28,7 +28,7 @@ jobs:
       
       # Setup tectonic
       - name: Install Tectonic
-        uses: wtfjoke/setup-tectonic@v2
+        uses: wtfjoke/setup-tectonic@e61d40cc462e10ce897e140d3ddc8fa76ac55a5f # v2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           tectonic-version: 0.14.1
@@ -52,7 +52,7 @@ jobs:
       # Upload pdf file in GitHub release
       - if: ${{ github.event_name == 'release'}}
         name: Upload pdf to release
-        uses: svenstaro/upload-release-action@v2
+        uses: svenstaro/upload-release-action@2b9d2847a97b04d02ad5c3df2d3a27baa97ce689 # v2
         with:
           repo_token: ${{ secrets.GITHUB_TOKEN }}
           file: "*.pdf"