From 067a3d78e7aa2450be15347f2cfdc788f439f4d1 Mon Sep 17 00:00:00 2001
From: Calin Teodor <t.calin@student.vu.nl>
Date: Wed, 14 Oct 2026 12:50:12 -0700
Subject: [PATCH] ci: pin third-party actions in release.yml to commit SHAs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 47e74643..d40c9c68 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -185,7 +185,7 @@ jobs:
             release/checksums.txt
 
       - name: Create GitHub release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           files: |
             release/*.tar.gz