From 09dcb42bf9f49b279b39bad24a07ffbfb5c59f24 Mon Sep 17 00:00:00 2001
From: mirkosalvato1-ctrl
 <227404546+mirkosalvato1-ctrl@users.noreply.github.com>
Date: Thu, 23 Jul 2026 09:50:21 +0200
Subject: [PATCH] ci: pin GitHub Actions to commit SHAs (2 pin(s))

---
 .github/workflows/npm-publish.yml              | 2 +-
 .github/workflows/trigger-licensed-release.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 5fd97f46d7c..9fa9fe2b668 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -91,7 +91,7 @@ jobs:
     steps:
       - name: Get app token
         id: app-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349  # v2
         with:
           app-id: ${{ secrets.IGNITEUI_GITHUB_APP_ID }}
           private-key: ${{ secrets.IGNITEUI_GITHUB_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/trigger-licensed-release.yml b/.github/workflows/trigger-licensed-release.yml
index 56a9e109c1d..cd2ff758b59 100644
--- a/.github/workflows/trigger-licensed-release.yml
+++ b/.github/workflows/trigger-licensed-release.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
       - name: Get app token
         id: app-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349  # v2
         with:
           app-id: ${{ secrets.IGNITEUI_GITHUB_APP_ID }}
           private-key: ${{ secrets.IGNITEUI_GITHUB_APP_PRIVATE_KEY }}