From 6cb420a5cd7df476fdf6f5da4419a6c45a497f77 Mon Sep 17 00:00:00 2001
From: Iris <iris.ho@mongodb.com>
Date: Tue, 13 Oct 2026 20:10:17 -0700
Subject: [PATCH] PYTHON-6075 Pin exact drivers-github-tools versions ahead of
 v4

---
 .github/workflows/release-python.yml | 12 ++++++------
 .github/zizmor.yml                   |  1 -
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release-python.yml b/.github/workflows/release-python.yml
index 8853cd26a..d37cc8638 100644
--- a/.github/workflows/release-python.yml
+++ b/.github/workflows/release-python.yml
@@ -37,16 +37,16 @@ jobs:
     outputs:
       version: ${{ steps.pre-publish.outputs.version }}
     steps:
-      - uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
+      - uses: mongodb-labs/drivers-github-tools/secure-checkout@11cb3898ea71493d38e8cdea7cc17b44320899e5  # v3.0.7
         with:
           app_id: ${{ vars.APP_ID }}
           private_key: ${{ secrets.APP_PRIVATE_KEY }}
-      - uses: mongodb-labs/drivers-github-tools/setup@v3
+      - uses: mongodb-labs/drivers-github-tools/setup@11cb3898ea71493d38e8cdea7cc17b44320899e5  # v3.0.7
         with:
           aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
           aws_region_name: ${{ vars.AWS_REGION_NAME }}
           aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
-      - uses: mongodb-labs/drivers-github-tools/python/pre-publish@v3
+      - uses: mongodb-labs/drivers-github-tools/python/pre-publish@11cb3898ea71493d38e8cdea7cc17b44320899e5  # v3.0.7
         id: pre-publish
         with:
           working_directory: ./bindings/python
@@ -105,16 +105,16 @@ jobs:
       attestations: write
       security-events: write
     steps:
-      - uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
+      - uses: mongodb-labs/drivers-github-tools/secure-checkout@11cb3898ea71493d38e8cdea7cc17b44320899e5  # v3.0.7
         with:
           app_id: ${{ vars.APP_ID }}
           private_key: ${{ secrets.APP_PRIVATE_KEY }}
-      - uses: mongodb-labs/drivers-github-tools/setup@v3
+      - uses: mongodb-labs/drivers-github-tools/setup@11cb3898ea71493d38e8cdea7cc17b44320899e5  # v3.0.7
         with:
           aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
           aws_region_name: ${{ vars.AWS_REGION_NAME }}
           aws_secret_id: ${{ secrets.AWS_SECRET_ID }}
-      - uses: mongodb-labs/drivers-github-tools/python/post-publish@v3
+      - uses: mongodb-labs/drivers-github-tools/python/post-publish@11cb3898ea71493d38e8cdea7cc17b44320899e5  # v3.0.7
         with:
           following_version: ${{ env.FOLLOWING_VERSION }}
           working_directory: ./bindings/python
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index 10fd4cdfc..854032f05 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -3,5 +3,4 @@ rules:
     config:
       policies:
         actions/*: ref-pin
-        mongodb-labs/drivers-github-tools/*: ref-pin
         mongodb-labs/drivers-evergreen-tools: ref-pin