From 1e89716e1e0e97470650e20411d9fbcc346b0e97 Mon Sep 17 00:00:00 2001
From: dominikg <dominik.goepel@gmx.de>
Date: Tue, 9 May 2023 19:48:33 +0200
Subject: [PATCH] fix: pin action that gets access to the private key of the
 ecosystem-ci-app

---
 .github/workflows/ecosystem-ci-trigger.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ecosystem-ci-trigger.yml b/.github/workflows/ecosystem-ci-trigger.yml
index 2b65fa173d..952f83a861 100644
--- a/.github/workflows/ecosystem-ci-trigger.yml
+++ b/.github/workflows/ecosystem-ci-trigger.yml
@@ -61,7 +61,7 @@ jobs:
               repo: pr.head.repo.full_name
             }
       - id: generate-token
-        uses: tibdex/github-app-token@v1
+        uses: tibdex/github-app-token@b62528385c34dbc9f38e5f4225ac829252d1ea92  #keep pinned for security reasons, currently 1.8.0
         with:
           app_id: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_ID }}
           private_key: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_PRIVATE_KEY }}