From de373ca92f5da92de0b706de41c1e69363525272 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 8 Apr 2026 20:33:08 +0000
Subject: [PATCH] Pin dependencies

---
 .github/actions/configure_bazelrc/action.yaml | 2 +-
 .github/workflows/release.yaml                | 2 +-
 .github/workflows/update-flake-lock.yml       | 2 +-
 .github/workflows/workflow.yaml               | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/actions/configure_bazelrc/action.yaml b/.github/actions/configure_bazelrc/action.yaml
index ad72a50bb..a4ba33e3a 100644
--- a/.github/actions/configure_bazelrc/action.yaml
+++ b/.github/actions/configure_bazelrc/action.yaml
@@ -20,7 +20,7 @@ runs:
         bazelrc_tmp="${BAZELRC}.tmp"
         cp "${BAZELRC}" "${bazelrc_tmp}"
         echo "bazelrc_tmp=${bazelrc_tmp}" >> "$GITHUB_OUTPUT"
-    - uses: tweag/configure-bazel-remote-cache-auth@v0
+    - uses: tweag/configure-bazel-remote-cache-auth@144b0b915f13a418f5eafe2f68d19564ec136c62 # v0
       with:
         buildbuddy_api_key: ${{ inputs.buildbuddy_api_key }}
         bazelrc_path: ${{ steps.create_bazelrc_tmp.outputs.bazelrc_tmp }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 6b04863a9..b9f0e1145 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -29,7 +29,7 @@ jobs:
           ref: master           # only create releases from main branch
       - name: Read section from CHANGELOG.md
         id: extract-changelog
-        uses: sean0x42/markdown-extract@v2
+        uses: sean0x42/markdown-extract@4178293dd16a52514b6cb2c01f4d309d264b2736 # v2
         with:
          file: CHANGELOG.md
          pattern: ${{ inputs.version }}
diff --git a/.github/workflows/update-flake-lock.yml b/.github/workflows/update-flake-lock.yml
index a56c74c17..989d26143 100644
--- a/.github/workflows/update-flake-lock.yml
+++ b/.github/workflows/update-flake-lock.yml
@@ -11,7 +11,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Install Nix
-        uses: cachix/install-nix-action@v30
+        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
         with:
           extra_nix_config: |
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index b6925f4ac..d1afb2f5c 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -144,7 +144,7 @@ jobs:
           popd
 
       - name: Build bazel-nix-python-container with Nix
-        uses: tweag/run-nix-shell@v0
+        uses: tweag/run-nix-shell@5d825ec7e0038b6c613f14d523203a2ea49abddb # v0
         if: ${{ runner.os == 'Linux' }}
         with:
           pure: false
@@ -152,7 +152,7 @@ jobs:
           run: bazel build :hello_image
 
       - name: Run bazel-nix-flakes-example with Nix
-        uses: tweag/run-nix-shell@v0
+        uses: tweag/run-nix-shell@5d825ec7e0038b6c613f14d523203a2ea49abddb # v0
         if: ${{ runner.os == 'Linux' }}
         with:
           pure: false