pin action references

Author: avidal

.github/workflows/release.yml

@@ -18,10 +18,10 @@ jobs:
       contents: write
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0 # needed to make sure we get all tags
-    - uses: actions/setup-go@v4
+    - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
       with:
         go-version: '1.24'
 
@@ -95,7 +95,7 @@ jobs:
         echo "tag=${TAG}" >> $GITHUB_OUTPUT
 
     - name: make release
-      uses: actions/github-script@v7
+      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
       with:
         script: |
           github.rest.git.createRef({