chore(): pin third party gh action to sha (#19)

* chore(): pin third party gh action to sha * chore(): add version as comment
rewindio · Sep 5, 2023 · 683d9d8 · 683d9d8
1 parent 26e95cc
commit 683d9d8
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/.github/workflows/tag-and-release.yml b/.github/workflows/tag-and-release.yml
@@ -2,7 +2,7 @@ name: tag-and-release
 
 on:
   push:
-    branches: 
+    branches:
       - main
     paths: 'lib/*/version.rb'
 
@@ -27,7 +27,7 @@ jobs:
         echo version_tag=v$version >> $GITHUB_OUTPUT
 
     - name: Tag commit
-      uses: tvdias/[email protected].1
+      uses: tvdias/github-tagger@ed7350546e3e503b5e942dffd65bc8751a95e49d # v0.0.2
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
         tag: "${{steps.get_version.outputs.version_tag}}"
@@ -61,9 +61,9 @@ jobs:
       run: |
         # Must use a temporary file or it loses the formatting
         VERSION=${{steps.get_version.outputs.version}}; awk "/## \[$VERSION\]/{flag=1;next}/## \[/{flag=0}flag" CHANGELOG.md > REL-BODY.md
-        
+
     - name: Create Release
-      uses: ncipollo/release-action@v1
+      uses: ncipollo/release-action@a2e71bdd4e7dab70ca26a852f29600c98b33153e # v1.13.0
       with:
         tag: ${{steps.get_version.outputs.version_tag}}
         artifacts: "*.gem, CHANGELOG.md"