chore: pin actions with commit sha

.github/workflows/ci-tests.yml

@@ -35,15 +35,15 @@ jobs:
           - windows-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
           python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
 
       - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238  # v6.2.0
         with:
           node-version: latest
 

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
 
       - name: Build matrix with action paths
         id: set-matrix
@@ -53,7 +53,7 @@ jobs:
         include: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
 
       - name: Setup bash (Alpine)
         shell: bash

.github/workflows/release.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
 
       - name: Setup Release
         id: setup-release

actions/audit_repos/action.yml

@@ -122,7 +122,7 @@ runs:
         INPUT_CHECK_CONTRIBUTING: ${{ inputs.checkContributing }}
         INPUT_CHECK_SECURITY: ${{ inputs.checkSecurity }}
         INPUT_CHECK_SPONSORS: ${{ inputs.checkSponsors }}
-      uses: actions/github-script@v8
+      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
       with:
         github-token: ${{ inputs.token }}
         script: |

actions/release_changelog/action.yml

@@ -27,7 +27,7 @@ runs:
       env:
         changelog_branch: ${{ inputs.changelogBranch }}
         changelog_file: ${{ inputs.changelogFile }}
-      uses: actions/github-script@v8
+      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
       with:
         github-token: ${{ inputs.token }}
         script: |

actions/release_create/action.yml

@@ -71,7 +71,7 @@ runs:
     - name: VirusTotal
       if: inputs.virustotal_api_key != ''
       id: vt
-      uses: cssnr/virustotal-action@v1.7.0
+      uses: cssnr/virustotal-action@e2d194486614b28c3cf884f4bf13e39cac959b8d  # v1.7.0
       with:
         file_globs: ${{ inputs.artifacts }}
         sha256: true
@@ -135,7 +135,7 @@ runs:
         } >> $GITHUB_OUTPUT
 
     - name: Create/Update GitHub Release
-      uses: ncipollo/release-action@v1.20.0
+      uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b  # v1.20.0
       with:
         allowUpdates: ${{ inputs.allowUpdates }}
         artifactErrorsFailBuild: ${{ inputs.artifactErrorsFailBuild }}
@@ -163,7 +163,7 @@ runs:
         SLEEP_DURATION: ${{ inputs.sleepDuration }}
         CURRENT_TAG: ${{ inputs.tag }}
       if: inputs.deleteOtherPreReleases == 'true'
-      uses: actions/github-script@v8
+      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
       with:
         github-token: ${{ inputs.token }}
         script: |

actions/release_homebrew/action.yml

@@ -102,7 +102,7 @@ runs:
 
     - name: Setup Python
       id: setup-python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
       with:
         python-version: "3.11"
         update-environment: false
@@ -138,7 +138,7 @@ runs:
         echo "::endgroup::"
 
     - name: Checkout (org homebrew repo)
-      uses: actions/checkout@v6
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
       with:
         repository: ${{ inputs.org_homebrew_repo }}
         ref: ${{ inputs.org_homebrew_repo_base_branch }}
@@ -148,7 +148,7 @@ runs:
 
     - name: Checkout (homebrew-core)
       if: ${{ inputs.contribute_to_homebrew_core == 'true' }}
-      uses: actions/checkout@v6
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
       with:
         repository: ${{ inputs.homebrew_core_fork_repo }}
         ref: ${{ inputs.homebrew_core_base_branch }}

actions/screenshot/action.yml

@@ -68,7 +68,7 @@ runs:
 
     - name: Upload artifacts
       if: github.repository == 'LizardByte/actions'
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
       with:
         name: screenshot-${{ runner.os }}
         path: screenshot.png

actions/setup_virtual_desktop/action.yml

@@ -61,7 +61,7 @@ runs:
     # For PR testing only
     - name: Checkout
       if: github.repository == 'LizardByte/actions'
-      uses: actions/checkout@v6
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
 
     - name: Tests
       if: github.repository == 'LizardByte/actions'
@@ -187,7 +187,7 @@ runs:
 
     - name: Upload screenshots
       if: github.repository == 'LizardByte/actions'
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
       with:
         name: ${{ steps.artifact-name.outputs.name }}
         path: tests/screenshots/*.png