From 825b15fd2683847a922f881abdb2ba48bcccfa7c Mon Sep 17 00:00:00 2001
From: brsouzapaypal <336266991+brsouzapaypal@users.noreply.github.com>
Date: Wed, 30 Sep 2026 18:43:15 -0300
Subject: [PATCH] LI-197586 Pin coveralls-python-action to release SHA

Replace the mutable @develop reference in ci.yml with the immutable commit
SHA of release v20201129, closing the supply-chain risk of running whatever
sits on the third-party action's develop branch (CWE-829).
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b724d12..abb9ffd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,4 +98,4 @@ jobs:
       - name: Coverage
         run: make coverage
 
-      - uses: AndreMiras/coveralls-python-action@develop
+      - uses: AndreMiras/coveralls-python-action@f5fd5c309b39d01599fb92c72d4f7409ea78aec9 # v20201129