# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

name: Harden CI security

on:
  workflow_call:
    inputs:
      target:
        required: true
        type: string

jobs:
  ensure-sha-pinned-actions:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
        with:
          ref: ${{ inputs.target }}
      - name: Ensure all actions are pinned to a specific commit
        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@40e45e738b3cad2729f599d8afc6ed02184e1dbd # v3.0.5