From 48b18f0a17f5f82841128985dead14f4e265d433 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 19:46:49 +0000
Subject: [PATCH] chore(deps): pin dependencies

---
 .github/workflows/apply-repo-settings.yaml | 4 ++--
 .github/workflows/dispatch-review.yaml     | 2 +-
 .github/workflows/pr-status-dispatch.yaml  | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/apply-repo-settings.yaml b/.github/workflows/apply-repo-settings.yaml
index c13b653..6a20213 100644
--- a/.github/workflows/apply-repo-settings.yaml
+++ b/.github/workflows/apply-repo-settings.yaml
@@ -50,14 +50,14 @@ jobs:
     steps:
       - name: Checkout as GitHub App
         id: checkout
-        uses: nsheaps/github-actions/.github/actions/checkout-as-app@main
+        uses: nsheaps/github-actions/.github/actions/checkout-as-app@847e6e595f069e4d3dbaafe43913c3af9930d6da # main
         with:
           app-id: ${{ secrets.AUTOMATION_GITHUB_APP_ID }}
           private-key: ${{ secrets.AUTOMATION_GITHUB_APP_PRIVATE_KEY }}
 
       - name: Apply
         id: apply
-        uses: nsheaps/github-actions/.github/actions/apply-repo-settings@main
+        uses: nsheaps/github-actions/.github/actions/apply-repo-settings@847e6e595f069e4d3dbaafe43913c3af9930d6da # main
         with:
           token: ${{ steps.checkout.outputs.token }}
           dry-run: ${{ inputs.dry-run || false }}
diff --git a/.github/workflows/dispatch-review.yaml b/.github/workflows/dispatch-review.yaml
index 6907f2b..14a3092 100644
--- a/.github/workflows/dispatch-review.yaml
+++ b/.github/workflows/dispatch-review.yaml
@@ -61,7 +61,7 @@ jobs:
     # on the next PR event in repos using this template. This is intentional —
     # operators who need pinned stability should replace @main with a commit SHA
     # and update it in lock-step with plugin version bumps.
-    uses: nsheaps/agents/.github/workflows/review-dispatch.yaml@main
+    uses: nsheaps/agents/.github/workflows/review-dispatch.yaml@16219f99ffa59e5c46e57c7839a51f7fc912b84e # main
     # secrets: inherit doesn't pass cross-repo (GitHub limitation).
     secrets:
       AUTOMATION_GITHUB_APP_ID: ${{ secrets.AUTOMATION_GITHUB_APP_ID }}
diff --git a/.github/workflows/pr-status-dispatch.yaml b/.github/workflows/pr-status-dispatch.yaml
index 5d7037d..782ccc3 100644
--- a/.github/workflows/pr-status-dispatch.yaml
+++ b/.github/workflows/pr-status-dispatch.yaml
@@ -41,7 +41,7 @@ jobs:
     steps:
       - name: Authenticate as GitHub App
         id: app-token
-        uses: nsheaps/github-actions/.github/actions/github-app-auth@main
+        uses: nsheaps/github-actions/.github/actions/github-app-auth@847e6e595f069e4d3dbaafe43913c3af9930d6da # main
         with:
           app-id: ${{ secrets.AUTOMATION_GITHUB_APP_ID }}
           private-key: ${{ secrets.AUTOMATION_GITHUB_APP_PRIVATE_KEY }}