From 5d2916b0ac5da04188aa4bd64658855ad40a9770 Mon Sep 17 00:00:00 2001
From: John Bampton <jbampton@gmail.com>
Date: Mon, 8 Jun 2026 23:51:23 +1000
Subject: [PATCH] [CI] Pin remaining actions to sha

---
 .github/workflows/npmtest.yml     | 2 +-
 .github/workflows/unittestlib.yml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/npmtest.yml b/.github/workflows/npmtest.yml
index de88d79ae1..08909ad6f0 100644
--- a/.github/workflows/npmtest.yml
+++ b/.github/workflows/npmtest.yml
@@ -25,7 +25,7 @@ jobs:
         which -a node || true
         which -a npm || true
         echo "==================="
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: '18.16.0'
     - name: Check Path 2
diff --git a/.github/workflows/unittestlib.yml b/.github/workflows/unittestlib.yml
index 44efae30f7..a31e4e2a94 100644
--- a/.github/workflows/unittestlib.yml
+++ b/.github/workflows/unittestlib.yml
@@ -31,7 +31,7 @@ jobs:
       if: ${{ runner.os == 'macOS' }}
       run: |
         brew install subversion
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         persist-credentials: false
     - name: Fix LDAP version and install SVN if necessary
@@ -45,7 +45,7 @@ jobs:
             sudo apt-get update && sudo apt-get install -y subversion
         fi
     - name: ruby
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
       with:
         ruby-version: ${{ matrix.ruby }}
         bundler-cache: true