From 90728b546fc63bef659ee1df7dc00f39132a83ba Mon Sep 17 00:00:00 2001
From: Oskar Eichler <oskar@songstats.com>
Date: Fri, 4 Sep 2026 20:25:07 +0700
Subject: [PATCH] Pin CI actions to immutable commits

---
 .github/workflows/test.yml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c2d38e1..7de2c0a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -2,6 +2,9 @@ name: Test
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Ruby ${{ matrix.ruby }} (${{ matrix.os }})
@@ -23,9 +26,9 @@ jobs:
         - macos-latest
     runs-on: ${{matrix.os}}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
     - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
       with:
         ruby-version: ${{matrix.ruby}}
         bundler-cache: true
@@ -48,9 +51,9 @@ jobs:
         - jruby
     runs-on: windows-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
     - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
       with:
         ruby-version: ${{matrix.ruby}}
         bundler-cache: true