From 57d89cc3d3509f65e1fe475fb7eb5ec1d321427a Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Wed, 7 Oct 2026 15:29:47 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/workflows/gosec.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/gosec.yaml b/.github/workflows/gosec.yaml
index a8e6ae7..cd4f8de 100644
--- a/.github/workflows/gosec.yaml
+++ b/.github/workflows/gosec.yaml
@@ -17,6 +17,6 @@ jobs:
          uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
 
        - name: Run Gosec Security Scanner
-         uses: securego/gosec@master
+         uses: securego/gosec@deb54465fea23d19a77f037e11e6589021f8501d # v2.29.0
          with:
            args: '-exclude-dir=.tools ./...'