krz/hutch

an ios client for sourcehut

clone: git clone https://gitbay.org/krz/hutch.git

f9f86b9681909b14304909b1286b9b50362625d7

verified · cmc

author: Christian Cleberg <hello@cleberg.net> · 2026-08-07T08:38:40Z

Pin create-pull-request action to a commit SHA

SonarCloud (githubactions:S7637) flags third-party actions referenced by
mutable tag as a supply-chain risk; pin to the v7 commit SHA.

 .github/workflows/sync-man-pages.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/sync-man-pages.yml b/.github/workflows/sync-man-pages.yml
index ea73e26..46c7701 100644
--- a/.github/workflows/sync-man-pages.yml
+++ b/.github/workflows/sync-man-pages.yml
@@ -40,7 +40,7 @@ jobs:
         run: python3 scripts/sync_man_pages.py
 
       - name: Open pull request on change
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
         with:
           add-paths: Hutch/Resources/man-pages.json
           branch: automated/man-page-catalog