From f9f86b9681909b14304909b1286b9b50362625d7 Mon Sep 17 00:00:00 2001 From: Christian Cleberg Date: Fri, 7 Aug 2026 03:38:40 -0500 Subject: Pin create-pull-request action to a commit SHA SonarCloud (githubactions:S7637) flags third-party actions referenced by mutable tag as a supply-chain risk; pin to the v7 commit SHA. --- .github/workflows/sync-man-pages.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/sync-man-pages.yml b/.github/workflows/sync-man-pages.yml index ea73e26..46c7701 100644 --- a/.github/workflows/sync-man-pages.yml +++ b/.github/workflows/sync-man-pages.yml @@ -40,7 +40,7 @@ jobs: run: python3 scripts/sync_man_pages.py - name: Open pull request on change - uses: peter-evans/create-pull-request@v7 + uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7 with: add-paths: Hutch/Resources/man-pages.json branch: automated/man-page-catalog -- cgit v1.2.3