require-pinned-github-actions.yml

name: Ensure actions are pinned to SHAs
on:
  pull_request:
    types:
      - opened
      - reopened
      - ready_for_review
      - synchronize
  merge_group:

jobs:
  check-actions-sha:
    name: Check actions are pinned to SHAs
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: Ensure SHA pinned actions
        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@b88cd0aad2c36a63e42c71f81cb1958fed95ac87 # v3.0.10