Merge pull request #3446 from github/mbg/ci/pin-node-packages

Author: mbg

.github/workflows/__bundle-from-toolcache.yml

@@ -4,7 +4,7 @@ versions:
   - toolcache
 steps:
   - name: Install @actions/tool-cache
-    run: npm install @actions/tool-cache
+    run: npm install @actions/tool-cache@3
   - name: Check toolcache contains CodeQL
     continue-on-error: true
     uses: actions/github-script@v8

.github/workflows/__bundle-toolcache.yml

@@ -16,7 +16,7 @@ steps:
         const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
         fs.rmdirSync(codeqlPath, { recursive: true });
   - name: Install @actions/tool-cache
-    run: npm install @actions/tool-cache
+    run: npm install @actions/tool-cache@3
   - name: Check toolcache does not contain CodeQL
     uses: actions/github-script@v8
     with: