From 3ad410ff51cff4f0cd7611e56e9d44fe57f7ef41 Mon Sep 17 00:00:00 2001
From: Cameron Brooks <95648474+CameronBrooks11@users.noreply.github.com>
Date: Thu, 22 Oct 2026 16:10:41 -0400
Subject: [PATCH] ci: pin actions to commit shas

These were the last tag-pinned action references in the org. A tag can
be moved to new code; a commit SHA cannot, and the org is about to
require SHA pinning, which would stop this workflow from running.
Same versions as before; Renovate keeps the SHAs current.
---
 .github/workflows/ci.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8805339..7a26e3a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,11 +13,11 @@ jobs:
     name: check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v6
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
         with:
           enable-cache: true
-      - uses: extractions/setup-just@v3
+      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3
       - run: just setup
       - run: just check
 
@@ -25,11 +25,11 @@ jobs:
     name: test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v6
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
         with:
           enable-cache: true
-      - uses: extractions/setup-just@v3
+      - uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3
       - run: just setup
       # Small sources are fetched so the reproduction tests run in CI. The EAGLE-I
       # archive (11.6 GB) is not; its tests read the committed aggregates and skip