Pin GitHub Actions to commit SHAs for supply chain security (#15)

Author: kevingosse

.github/workflows/ci.yml

@@ -8,10 +8,10 @@ jobs:
   build:
     runs-on: windows-2025-vs2026
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Setup MSBuild
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2
 
       - name: Build Release
         run: msbuild src\ClipPing.sln /p:Configuration=Release /p:Platform=x64

.github/workflows/release.yml

@@ -15,7 +15,7 @@ jobs:
   build:
     runs-on: windows-2025-vs2026
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Validate version
         shell: bash
@@ -75,7 +75,7 @@ jobs:
           git push origin HEAD "v${{ inputs.version }}"
 
       - name: Setup MSBuild
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2
 
       - name: Build Release
         run: msbuild src\ClipPing.sln /p:Configuration=Release /p:Platform=x64
@@ -87,7 +87,7 @@ jobs:
         run: iscc /DMyAppVersion=${{ inputs.version }} installer.iss
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
         with:
           tag_name: v${{ inputs.version }}
           files: |