From c7f02e03b8373338359d83e5925c514ebe721817 Mon Sep 17 00:00:00 2001
From: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com>
Date: Wed, 26 Jun 2024 16:13:03 -0400
Subject: [PATCH] chore: pin new sign installer to commit sha (#1966)

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
---
 .github/workflows/validations.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/validations.yaml b/.github/workflows/validations.yaml
index e8130cbebf1..2e236b48de2 100644
--- a/.github/workflows/validations.yaml
+++ b/.github/workflows/validations.yaml
@@ -178,7 +178,7 @@ jobs:
     runs-on: macos-latest
     steps:
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v3.5.0
+        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7