From 12b4b97d7f4e9a9b87de869d6f95eca67ed661f5 Mon Sep 17 00:00:00 2001
From: Vecko <36369090+VeckoTheGecko@users.noreply.github.com>
Date: Tue, 20 Jan 2026 14:06:12 +0100
Subject: [PATCH] Add sha pins

Fixes #6
---
 create-and-cache/action.yml | 6 +++---
 restore/action.yml          | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/create-and-cache/action.yml b/create-and-cache/action.yml
index 04266f9..f5233d8 100644
--- a/create-and-cache/action.yml
+++ b/create-and-cache/action.yml
@@ -27,14 +27,14 @@ runs:
         echo "key=${key}" >> "$GITHUB_OUTPUT"
 
     - name: Restore pixi.lock from cache
-      uses: actions/cache/restore@v5
+      uses: actions/cache/restore@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5.0.2
       id: restore
       with:
         path: pixi.lock
         key: ${{ steps.cache-key.outputs.key }}
 
     - name: Setup pixi
-      uses: prefix-dev/setup-pixi@v0.9.3
+      uses: prefix-dev/setup-pixi@82d477f15f3a381dbcc8adc1206ce643fe110fb7 # v0.9.3
       if: ${{ !steps.restore.outputs.cache-hit }}
       with:
         pixi-version: ${{ inputs.pixi-version }}
@@ -46,7 +46,7 @@ runs:
       run: pixi lock
 
     - name: Save pixi.lock to cache
-      uses: actions/cache/save@v5
+      uses: actions/cache/save@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5.0.2
       if: ${{ !steps.restore.outputs.cache-hit }}
       with:
         path: pixi.lock
diff --git a/restore/action.yml b/restore/action.yml
index 79b27d6..917afdd 100644
--- a/restore/action.yml
+++ b/restore/action.yml
@@ -22,7 +22,7 @@ runs:
         echo "key=${base}_${yesterday}" >> "$GITHUB_OUTPUT"
 
     - name: Restore pixi.lock from cache
-      uses: actions/cache/restore@v5
+      uses: actions/cache/restore@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5.0.2
       id: restore
       with:
         path: pixi.lock