# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

name: Harden CI security

on:
  workflow_call:
    inputs:
      target:
        required: true
        type: string

jobs:
  ensure-sha-pinned-actions:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          ref: ${{ inputs.target }}
      - name: Ensure all actions are pinned to a specific commit
        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@555a30da2656b4a7cf47b107800bef097723363e # v2.1.3