From f4c5f6512385eafebef739db4616c3b3ae84c328 Mon Sep 17 00:00:00 2001
From: jhesch <regard.canter.7m@icloud.com>
Date: Wed, 29 Jul 2026 10:38:29 -0700
Subject: [PATCH] Pin actions/checkout to a commit SHA

Use the immutable v6.1.0 commit instead of its mutable release tag.
---
 .github/workflows/build-test.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml
index 34584fb..a32cbdf 100644
--- a/.github/workflows/build-test.yaml
+++ b/.github/workflows/build-test.yaml
@@ -12,7 +12,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - run: npm ci
       - run: npm run all
   get-dirty:
@@ -23,7 +23,7 @@ jobs:
       clean-bits: ${{ steps.dirty-bits.outputs.clean-bits }}
       dirty-bits: ${{ steps.dirty-bits.outputs.dirty-bits }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - uses: ./
         id: dirty-bits
         with: