From 853b8a50eb82d4e55cc17512bcd55a53a79aa0ab Mon Sep 17 00:00:00 2001
From: Austin Pray <71290498+austinpray-mixpanel@users.noreply.github.com>
Date: Tue, 24 Mar 2026 03:46:47 +0000
Subject: [PATCH] chore: pin GitHub Actions to full commit SHAs

---
 .github/workflows/ruby.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml
index c981835..83e4a50 100644
--- a/.github/workflows/ruby.yml
+++ b/.github/workflows/ruby.yml
@@ -22,7 +22,7 @@ jobs:
           - '3.4'
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
     - name: Set up Ruby
       uses: ruby/setup-ruby@d697be2f83c6234b20877c3b5eac7a7f342f0d0c # v1.269.0
       with:
@@ -31,7 +31,7 @@ jobs:
     - name: Run tests
       run: bundle exec rake
     - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@v5
+      uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad  # v5
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         slug: mixpanel/mixpanel-ruby