From 2d2d584800ece634ea8d0933562c6f8e06ceae7c Mon Sep 17 00:00:00 2001
From: slawomirbabicz <111378977+slawomirbabicz@users.noreply.github.com>
Date: Wed, 8 Apr 2026 16:39:14 +0200
Subject: [PATCH 1/2] chore: pin actions to SHA in
 .github/workflows/markdown-mermaid.yml

---
 .github/workflows/markdown-mermaid.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/markdown-mermaid.yml b/.github/workflows/markdown-mermaid.yml
index 7501519..46fe86c 100644
--- a/.github/workflows/markdown-mermaid.yml
+++ b/.github/workflows/markdown-mermaid.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       with:
         fetch-depth: 2
     - name: get changed files
@@ -26,7 +26,7 @@ jobs:
         echo ${{ steps.getfile.outputs.files }}
 
     - name: compile mermaid
-      uses: neenjaw/compile-mermaid-markdown-action@0.2.3
+      uses: neenjaw/compile-mermaid-markdown-action@e1b6221471a7e224f84ad0939d05c92ce085a056 # 0.2.3
       with:
         files: ${{ steps.getfile.outputs.files }}
         output: 'output'
@@ -40,7 +40,7 @@ jobs:
 
     - name: Create Pull Request
       id: cpr
-      uses: peter-evans/create-pull-request@v2
+      uses: peter-evans/create-pull-request@4d3b0a48efaa29be1a91dbe756c93798daf406d5 # v2.8.1
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         commit-message: Add compiled mermaid

From 44f9256e226aef1838f63338f7ee31a8c37773ee Mon Sep 17 00:00:00 2001
From: slawomirbabicz <111378977+slawomirbabicz@users.noreply.github.com>
Date: Wed, 8 Apr 2026 16:39:16 +0200
Subject: [PATCH 2/2] chore: pin actions to SHA in .github/workflows/rust.yml

---
 .github/workflows/rust.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 7ebdb4a..1464aaa 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
     - name: Build native mode
       run: |
         echo y | DFX_VERSION=0.6.9 bash -ci "$(curl -fsSL https://sdk.dfinity.org/install.sh)"