From c6e2b2e6db863c3e36d1ef631eb5a6a3e60aadac Mon Sep 17 00:00:00 2001
From: Devon Powley <devon@endor.ai>
Date: Wed, 25 Mar 2026 10:52:15 -0400
Subject: [PATCH] Pin GHAs

---
 .github/workflows/mirai_on_mirai.yml | 6 +++---
 .github/workflows/rust.yml           | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/mirai_on_mirai.yml b/.github/workflows/mirai_on_mirai.yml
index 15f4d600..3d9ec80d 100644
--- a/.github/workflows/mirai_on_mirai.yml
+++ b/.github/workflows/mirai_on_mirai.yml
@@ -25,11 +25,11 @@ jobs:
     env:
       VCPKG_ROOT: ${{ github.workspace }}/vcpkg
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           submodules: recursive
       - name: Install LLVM and Clang # required for bindgen to work, see https://github.com/rust-lang/rust-bindgen/issues/1797
-        uses: KyleMayes/install-llvm-action@v1
+        uses: KyleMayes/install-llvm-action@1a3da29f56261a1e1f937ec88f0856a9b8321d7e # v1
         if: matrix.os == 'windows-latest'
         with:
           version: "11.0"
@@ -39,7 +39,7 @@ jobs:
         if: matrix.os == 'windows-latest'
       - run: echo  Installing z3:${{ matrix.vcpkg_triplet }} on ${{ matrix.os }}.
       - name: vcpkg build z3
-        uses: johnwason/vcpkg-action@v5
+        uses: johnwason/vcpkg-action@3839b028ca2400865ef5e83a899f336b1b8fd711 # v5
         id: vcpkg
         with:
           pkgs: z3
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index bf1c635e..26a13f9c 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -10,7 +10,7 @@ jobs:
   clippy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Run Clippy
         run: |
@@ -22,12 +22,12 @@ jobs:
       VCPKG_ROOT: ${{ github.workspace }}/vcpkg
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           submodules: recursive
 
       - name: vcpkg build z3
-        uses: johnwason/vcpkg-action@v5
+        uses: johnwason/vcpkg-action@3839b028ca2400865ef5e83a899f336b1b8fd711 # v5
         id: vcpkg
         with:
           pkgs: z3
@@ -63,7 +63,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Install MIRAI
         run: |