Reference fossa workflow actions by SHA (#148)

This references fossa workflow actions by SHA, which #141 missed.
uber-go · Dec 12, 2023 · 379ee39 · 379ee39
1 parent eaa15b8
commit 379ee39
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/.github/workflows/fossa.yaml b/.github/workflows/fossa.yaml
@@ -11,10 +11,10 @@ jobs:
     if: github.repository_owner == 'uber-go'
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2 # v4.0.0
 
       - name: FOSSA analysis
-        uses: fossas/fossa-action@v1
+        uses: fossas/fossa-action@f61a4c0c263690f2ddb54b9822a719c25a7b608f # v1.0.0
         with:
           api-key: ${{ secrets.FOSSA_API_KEY }}