From c617c15de3fa7094c55654cdb3c3e60fac8f8d1e Mon Sep 17 00:00:00 2001 From: Pelle Wessman Date: Thu, 1 Aug 2024 15:04:54 +0200 Subject: [PATCH] ci: lock down third party action Its best practice to lock down third party actions to hash, since the tags are not immutable --- .github/workflows/cron.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/cron.yml b/.github/workflows/cron.yml index 2ac950b..dba1c7c 100644 --- a/.github/workflows/cron.yml +++ b/.github/workflows/cron.yml @@ -23,7 +23,7 @@ jobs: run: npm install - name: Update run: npm run update:unicode - - uses: peter-evans/create-pull-request@v6 + - uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c with: commit-message: "fix: updates unicode resource with latest" branch: update-unicode-resource @@ -44,7 +44,7 @@ jobs: run: npm install - name: Update run: npm run update:test262:extract - - uses: peter-evans/create-pull-request@v6 + - uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c with: commit-message: "test: updates test cases extracted from test262" branch: update-test262