From 99451e1d42b940848fc4fc6715174fc0a6abc7f4 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 21 Apr 2026 20:00:18 +0000
Subject: [PATCH] ci: pin dependencies

---
 .github/workflows/ci.yml          |  6 +++---
 .github/workflows/relesae-plz.yml | 10 +++++-----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1b85f55..93b7cd5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,11 +36,11 @@ jobs:
           git config --global fetch.parallel 32
 
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
 
       - name: Run sccache-cache
         if: github.repository == 'YoloDev/rkyv-utils'
-        uses: mozilla-actions/sccache-action@v0.0.9
+        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
 
       - name: Configure sccache
         if: github.repository == 'YoloDev/rkyv-utils'
@@ -99,7 +99,7 @@ jobs:
           git config --global fetch.parallel 32
 
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@nightly
+      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2 # nightly
         with:
           components: miri
 
diff --git a/.github/workflows/relesae-plz.yml b/.github/workflows/relesae-plz.yml
index 1a31e44..eabef4a 100644
--- a/.github/workflows/relesae-plz.yml
+++ b/.github/workflows/relesae-plz.yml
@@ -35,11 +35,11 @@ jobs:
           token: ${{ steps.generate-token.outputs.token }}
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
 
       - name: Run sccache-cache
         if: github.repository == 'YoloDev/rkyv-utils'
-        uses: mozilla-actions/sccache-action@v0.0.9
+        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
 
       - name: Configure sccache
         if: github.repository == 'YoloDev/rkyv-utils'
@@ -64,7 +64,7 @@ jobs:
           SCCACHE_SECRET_ACCESS_KEY: ${{ secrets.SCCACHE_SECRET_ACCESS_KEY }}
 
       - name: Run release-plz
-        uses: MarcoIeni/release-plz-action@v0.5
+        uses: MarcoIeni/release-plz-action@1528104d2ca23787631a1c1f022abb64b34c1e11 # v0.5
         with:
           command: release
         env:
@@ -96,11 +96,11 @@ jobs:
           token: ${{ steps.generate-token.outputs.token }}
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
 
       - name: Run sccache-cache
         if: github.repository == 'YoloDev/rkyv-utils'
-        uses: mozilla-actions/sccache-action@v0.0.9
+        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
 
       - name: Configure sccache
         if: github.repository == 'YoloDev/rkyv-utils'