From 09377d1891865a82cfeba18d8763d36f9e92aaaa Mon Sep 17 00:00:00 2001
From: "hf-security-analysis[bot]"
 <265538906+hf-security-analysis[bot]@users.noreply.github.com>
Date: Tue, 15 Sep 2026 08:49:30 +0000
Subject: [PATCH] fix(ci): harden workflow files flagged on #1138

---
 .github/workflows/discovery-catalog.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/discovery-catalog.yml b/.github/workflows/discovery-catalog.yml
index 9f78a1c170..a7706c16bd 100644
--- a/.github/workflows/discovery-catalog.yml
+++ b/.github/workflows/discovery-catalog.yml
@@ -26,8 +26,8 @@ jobs:
   snapshot:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
       - run: uv sync --group dev
       - name: Check the profile and producer
         run: |
@@ -48,7 +48,7 @@ jobs:
           SOURCE_REPOSITORY: ${{ github.repository }}
           SOURCE_OWNER: ${{ github.repository_owner }}
           SOURCE_REVISION: ${{ github.sha }}
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: openenv-catalog-${{ github.sha }}
           path: openenv-catalog.json