From 20aa97654c4177feb2ff9570ee9ad01028f334cb Mon Sep 17 00:00:00 2001
From: Nicolas Joubert <njoubert@clever-age.com>
Date: Fri, 6 Nov 2026 17:08:11 +0100
Subject: [PATCH] #122 - Pin the GitHub actions of the workflows by commit SHA

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/quality.yml | 24 ++++++++++++------------
 .github/workflows/test.yml    |  6 +++---
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index a0fd1ee..b7a8a1f 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -15,15 +15,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install PHP with extensions
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
         with:
           php-version: '8.5'
           coverage: none
           tools: composer:v2
       - name: Install Composer dependencies (locked)
-        uses: ramsey/composer-install@v4
+        uses: ramsey/composer-install@26d8a556604053a9612623447203a691f406fbe6 # v4
       - name: Warmup cache
         run: bin/console cache:warmup
       - name: PHPStan
@@ -34,15 +34,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install PHP with extensions
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
         with:
           php-version: '8.5'
           coverage: none
           tools: composer:v2
       - name: Install Composer dependencies (locked)
-        uses: ramsey/composer-install@v4
+        uses: ramsey/composer-install@26d8a556604053a9612623447203a691f406fbe6 # v4
       - name: PHP-CS-Fixer
         run: vendor/bin/php-cs-fixer fix --diff --dry-run --show-progress=none
 
@@ -51,15 +51,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install PHP with extensions
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
         with:
           php-version: '8.5'
           coverage: none
           tools: composer:v2
       - name: Install Composer dependencies (locked)
-        uses: ramsey/composer-install@v4
+        uses: ramsey/composer-install@26d8a556604053a9612623447203a691f406fbe6 # v4
       - name: Rector
         run: vendor/bin/rector --no-progress-bar --dry-run
 
@@ -68,15 +68,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install PHP with extensions
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
         with:
           php-version: '8.5'
           coverage: none
           tools: composer:v2
       - name: Install Composer dependencies (locked)
-        uses: ramsey/composer-install@v4
+        uses: ramsey/composer-install@26d8a556604053a9612623447203a691f406fbe6 # v4
       - name: Lint the container
         run: bin/console lint:container
       - name: Lint the YAML files
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b49e0ce..71a0baa 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -81,9 +81,9 @@ jobs:
             variant: symfony/symfony:"8.*"
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install PHP with extensions
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
         with:
           php-version: ${{ matrix.php-version }}
           coverage: pcov
@@ -94,7 +94,7 @@ jobs:
         if: matrix.variant != 'normal' && !startsWith(matrix.variant, 'symfony/symfony')
         run: composer require ${{ matrix.variant }} --no-update
       - name: Install Composer dependencies (${{ matrix.dependencies }})
-        uses: ramsey/composer-install@v4
+        uses: ramsey/composer-install@26d8a556604053a9612623447203a691f406fbe6 # v4
         with:
           dependency-versions: ${{ matrix.dependencies }}
       - name: Run Tests with coverage