From c8e6879ea91a60be71f94cb358e7fca344897d3e Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 15:37:16 +0000
Subject: [PATCH] chore(deps): pin dependencies

---
 .github/workflows/apply-repo-settings.yaml | 4 ++--
 .github/workflows/dispatch-review.yaml     | 2 +-
 .github/workflows/pr-status-dispatch.yaml  | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/apply-repo-settings.yaml b/.github/workflows/apply-repo-settings.yaml
index 0cbbd989..781ae592 100644
--- a/.github/workflows/apply-repo-settings.yaml
+++ b/.github/workflows/apply-repo-settings.yaml
@@ -50,14 +50,14 @@ jobs:
     steps:
       - name: Checkout as GitHub App
         id: checkout
-        uses: nsheaps/github-actions/.github/actions/checkout-as-app@main
+        uses: nsheaps/github-actions/.github/actions/checkout-as-app@c1794f6f4fbb3cbc5e5a71e820581a74239f706a # main
         with:
           app-id: ${{ secrets.AUTOMATION_GITHUB_APP_ID }}
           private-key: ${{ secrets.AUTOMATION_GITHUB_APP_PRIVATE_KEY }}
 
       - name: Apply
         id: apply
-        uses: nsheaps/github-actions/.github/actions/apply-repo-settings@main
+        uses: nsheaps/github-actions/.github/actions/apply-repo-settings@c1794f6f4fbb3cbc5e5a71e820581a74239f706a # main
         with:
           token: ${{ steps.checkout.outputs.token }}
           dry-run: ${{ inputs.dry-run || false }}
diff --git a/.github/workflows/dispatch-review.yaml b/.github/workflows/dispatch-review.yaml
index 7206c0c4..8ea738c4 100644
--- a/.github/workflows/dispatch-review.yaml
+++ b/.github/workflows/dispatch-review.yaml
@@ -53,7 +53,7 @@ jobs:
     # on the next PR event in repos using this template. This is intentional —
     # operators who need pinned stability should replace @main with a commit SHA
     # and update it in lock-step with plugin version bumps.
-    uses: nsheaps/agents/.github/workflows/review-dispatch.yaml@main
+    uses: nsheaps/agents/.github/workflows/review-dispatch.yaml@625b33b3d106b9cf574527aef6edccdf6e7af4f0 # main
     # secrets: inherit doesn't pass cross-repo (GitHub limitation).
     secrets:
       AUTOMATION_GITHUB_APP_ID: ${{ secrets.AUTOMATION_GITHUB_APP_ID }}
diff --git a/.github/workflows/pr-status-dispatch.yaml b/.github/workflows/pr-status-dispatch.yaml
index 5d7037d5..2a6dc345 100644
--- a/.github/workflows/pr-status-dispatch.yaml
+++ b/.github/workflows/pr-status-dispatch.yaml
@@ -41,7 +41,7 @@ jobs:
     steps:
       - name: Authenticate as GitHub App
         id: app-token
-        uses: nsheaps/github-actions/.github/actions/github-app-auth@main
+        uses: nsheaps/github-actions/.github/actions/github-app-auth@c1794f6f4fbb3cbc5e5a71e820581a74239f706a # main
         with:
           app-id: ${{ secrets.AUTOMATION_GITHUB_APP_ID }}
           private-key: ${{ secrets.AUTOMATION_GITHUB_APP_PRIVATE_KEY }}