From 702166b1ef1c38b2c6722c2098b502feee3cce89 Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Wed, 7 Oct 2026 17:41:38 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/workflows/prompty-python.yml     | 2 +-
 .github/workflows/prompty-rust-check.yml | 2 +-
 .github/workflows/prompty-rust.yml       | 2 +-
 .github/workflows/schema-repro-check.yml | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/prompty-python.yml b/.github/workflows/prompty-python.yml
index 64360bef8..f19647f19 100644
--- a/.github/workflows/prompty-python.yml
+++ b/.github/workflows/prompty-python.yml
@@ -85,6 +85,6 @@ jobs:
           flit build --format sdist
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           packages-dir: ./runtime/python/prompty/dist
diff --git a/.github/workflows/prompty-rust-check.yml b/.github/workflows/prompty-rust-check.yml
index 82d4714b5..0bedb744d 100644
--- a/.github/workflows/prompty-rust-check.yml
+++ b/.github/workflows/prompty-rust-check.yml
@@ -25,7 +25,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1
         with:
           toolchain: ${{ matrix.toolchain }}
           components: rustfmt, clippy
diff --git a/.github/workflows/prompty-rust.yml b/.github/workflows/prompty-rust.yml
index 9773cc7eb..25f78c8ee 100644
--- a/.github/workflows/prompty-rust.yml
+++ b/.github/workflows/prompty-rust.yml
@@ -43,7 +43,7 @@ jobs:
           ref: ${{ github.event.pull_request.merge_commit_sha || github.ref }}
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1
 
       - name: Resolve release version
         run: |
diff --git a/.github/workflows/schema-repro-check.yml b/.github/workflows/schema-repro-check.yml
index bb18a8c06..419466460 100644
--- a/.github/workflows/schema-repro-check.yml
+++ b/.github/workflows/schema-repro-check.yml
@@ -130,7 +130,7 @@ jobs:
       #   dotnet    csharp/driver.js runs `dotnet format <csproj>`
       #   gofmt     go/driver.js runs `gofmt -w` (and `goimports -w` if present)
       - name: Install Rust toolchain (provides rustfmt)
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1
         with:
           toolchain: '1.97.1'
           components: rustfmt