From 23e8221ed595d97ebab9bd1b862bcce922ad6fb4 Mon Sep 17 00:00:00 2001
From: "hf-security-analysis[bot]"
 <265538906+hf-security-analysis[bot]@users.noreply.github.com>
Date: Wed, 23 Sep 2026 12:37:25 +0000
Subject: [PATCH] Pin GitHub Actions to commit SHAs

A tag is mutable: whoever controls the action's repository can move
`v4` to different code, and the next run picks it up with no diff to
review. Pinning to the commit SHA freezes the code that runs today.
---
 .github/workflows/lockfile_registry_guard.yml | 2 +-
 .github/workflows/sync_space.yml              | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/lockfile_registry_guard.yml b/.github/workflows/lockfile_registry_guard.yml
index 6332715db..0b865809c 100644
--- a/.github/workflows/lockfile_registry_guard.yml
+++ b/.github/workflows/lockfile_registry_guard.yml
@@ -27,7 +27,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Reject internal npm mirror URLs
diff --git a/.github/workflows/sync_space.yml b/.github/workflows/sync_space.yml
index aab082a6b..fd595f3c3 100644
--- a/.github/workflows/sync_space.yml
+++ b/.github/workflows/sync_space.yml
@@ -14,7 +14,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           lfs: true
           persist-credentials: false