fix: pin action that gets access to the private key of the ecosystem-ci-app

3 years ago · 1e89716e1e
parent de93a446ee
commit 1e89716e1e
1 changed files with 1 additions and 1 deletions
--- a/.github/workflows/ecosystem-ci-trigger.yml
+++ b/.github/workflows/ecosystem-ci-trigger.yml
@ -61,7 +61,7 @@ jobs:
              repo: pr.head.repo.full_name
            }
      - id: generate-token
-        uses: tibdex/github-app-token@v1
+        uses: tibdex/github-app-token@b62528385c34dbc9f38e5f4225ac829252d1ea92  #keep pinned for security reasons, currently 1.8.0
        with:
          app_id: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_ID }}
          private_key: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_PRIVATE_KEY }}