Reference fossa workflow actions by SHA

This references fossa workflow actions by SHA, which uber-go#141 missed.
JacobOaks · Dec 12, 2023 · 3c2651e · 3c2651e
1 parent eaa15b8
commit 3c2651e
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/.github/workflows/fossa.yaml b/.github/workflows/fossa.yaml
@@ -11,10 +11,10 @@ jobs:
     if: github.repository_owner == 'uber-go'
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2 # v4.0.0
 
       - name: FOSSA analysis
-        uses: fossas/fossa-action@v1
+        uses: fossas/fossa-action@f61a4c0c263690f2ddb54b9822a719c25a7b608f # v1.0.0
         with:
           api-key: ${{ secrets.FOSSA_API_KEY }}