# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

name: Harden CI security

on:
  workflow_call:
    inputs:
      target:
        required: true
        type: string

jobs:
  ensure-sha-pinned-actions:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
        with:
          ref: ${{ inputs.target }}
      - name: Ensure all actions are pinned to a specific commit
        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@ba37328d4ea95eaf8b3bd6c6cef308f709a5f2ec # v3.0.3