use hash

code-scanning/phpmd.yml

@@ -16,7 +16,6 @@ on:
     branches: [ $default-branch ]
   schedule:
     - cron: $cron-weekly
-  # workflow_dispatch:
 
 permissions:
   contents: read
@@ -34,7 +33,7 @@ jobs:
         uses: actions/checkout@v3
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@aa1fe473f9c687b6fb896056d771232c0bc41161
         with:
           coverage: none
           tools: phpmd