From ec3754e27899d520c4ba4fe1258c5ed5d9c8cb94 Mon Sep 17 00:00:00 2001
From: "hf-security-analysis[bot]"
 <265538906+hf-security-analysis[bot]@users.noreply.github.com>
Date: Wed, 16 Sep 2026 10:20:53 +0000
Subject: [PATCH] fix(ci): harden workflow files flagged on #1179

---
 .github/workflows/validation-runtime.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/validation-runtime.yml b/.github/workflows/validation-runtime.yml
index 5464560b7..d4a9aebb6 100644
--- a/.github/workflows/validation-runtime.yml
+++ b/.github/workflows/validation-runtime.yml
@@ -15,14 +15,14 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12.13"
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           version: "0.9.3"
           enable-cache: true
@@ -42,7 +42,7 @@ jobs:
           done
       - name: Retain evidence on success or failure
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: validation-runtime-${{ github.event.pull_request.head.sha || github.sha }}
           path: outputs/validation-runtime/