# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

name: Harden CI security

on:
  workflow_call:
    inputs:
      target:
        required: true
        type: string

jobs:
  ensure-sha-pinned-actions:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          ref: ${{ inputs.target }}
      - name: Ensure all actions are pinned to a specific commit
        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@b1b635d24259e8a047a6ce7d6501ea432aa7a830 # v3.0.2