Merge pull request #2 from aboutcode-org/keshav-space-patch-1

chore(security): pin down actions to commit SHA

Author: keshav-space

.github/workflows/sync.yml

@@ -10,11 +10,11 @@ permissions:
 
 jobs:
   scheduled:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Run sync
         run: wget --mirror --no-parent --reject "index.html*" --no-host-directories -P secdb https://secdb.alpinelinux.org/
@@ -25,4 +25,4 @@ jobs:
           git config user.email "automation@aboutcode.org"
           git add -A
           git commit -m "$(echo -e "Sync latest Alpine secdb\n\nSigned-off-by: AboutCode Automation <automation@aboutcode.org>")" || exit 0
-          git push
+          git push