From 346a9313f309954b126f32788c1de45de7a3e19e Mon Sep 17 00:00:00 2001
From: Scott Barr <sbarr@wealthsimple.com>
Date: Sun, 3 May 2026 19:38:49 -0400
Subject: [PATCH] chore: pin GitHub Actions to SHAs [skip deploy]

Pins the following actions to their latest safe release (>5 days old):
- actions/checkout: pinned to v6.0.2 (de0fac2e)
- ruby/setup-ruby: pinned to v1.306.0 (c4e5b131)
---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f21e5a4..df836aa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -66,14 +66,14 @@ jobs:
 
     steps:
     - name: Checkout current branch
-      uses: actions/checkout@v2
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Install sqlite3 on system
       run: |
         sudo apt-get install libsqlite3-dev
 
     - name: Setup Ruby
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
       with:
         ruby-version: ${{ matrix.ruby }}
         bundler: '2.4.22'