From a3354da0e85f0f85f155f9cdf505318c47b203d6 Mon Sep 17 00:00:00 2001
From: Thomas Piccirello <tom.p@posthog.com>
Date: Wed, 20 May 2026 22:46:52 -0700
Subject: [PATCH] chore: pin github actions to sha

---
 .github/workflows/docker-build-push.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/docker-build-push.yml b/.github/workflows/docker-build-push.yml
index c3f752d..93efa11 100644
--- a/.github/workflows/docker-build-push.yml
+++ b/.github/workflows/docker-build-push.yml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
       - name: Extract versions from Dockerfile
         id: versions
@@ -70,7 +70,7 @@ jobs:
           echo "  IMAGE_VERSION: $IMAGE_VERSION"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0
 
       - name: Login to GitHub Container Registry
         if: github.event_name == 'push'