From 77eb4c80bf77167de07ecad3282860ba5c6d19e5 Mon Sep 17 00:00:00 2001
From: Mendral AI <sam+githubbot@mendral.com>
Date: Tue, 7 Apr 2026 23:44:21 -0700
Subject: [PATCH] fix(ci): pin lingodotdev/lingo.dev action to SHA to prevent
 supply chain risk (#28774)

Signed-off-by: Mendral Agent <support@mendral.com>
Co-authored-by: Mendral Agent <support@mendral.com>
---
 .github/workflows/i18n.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/i18n.yml b/.github/workflows/i18n.yml
index 592cf462d9..62824f4417 100644
--- a/.github/workflows/i18n.yml
+++ b/.github/workflows/i18n.yml
@@ -30,7 +30,7 @@ jobs:
         with:
           node-version: 20
           cache: 'npm'
-      - uses: lingodotdev/lingo.dev@main
+      - uses: lingodotdev/lingo.dev@cee3eb86550ca4905fc99fe90786fb7523288a61 # main
         env:
           GH_TOKEN: ${{ steps.generate-token.outputs.token }}
         with: