From 8e3aba286385e002509b8ac032e0c0fe4e9b97ec Mon Sep 17 00:00:00 2001
From: Federico Grandi <fgrandi30@gmail.com>
Date: Sun, 9 Aug 2026 00:28:34 +0200
Subject: [PATCH] ci: pin actions-tagger and restrict release workflow
 permissions

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/versioning.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/versioning.yml b/.github/workflows/versioning.yml
index b9def1a3..bbd785b9 100644
--- a/.github/workflows/versioning.yml
+++ b/.github/workflows/versioning.yml
@@ -4,10 +4,13 @@ on:
   release:
     types: [published, edited]
 
+permissions:
+  contents: write
+
 jobs:
   actions-tagger:
     runs-on: windows-2022
     steps:
-      - uses: Actions-R-Us/actions-tagger@v2
+      - uses: Actions-R-Us/actions-tagger@330ddfac760021349fef7ff62b372f2f691c20fb # v2.0.3
         with:
           publish_latest_tag: true