Pin dependencies

.github/workflows/release.yaml

@@ -15,14 +15,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Build the dist
         run: make all
         if: startsWith(github.ref, 'refs/tags/')
 
       - name: Release GHA
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
         if: startsWith(github.ref, 'refs/tags/')
         with:
           generate_release_notes: true

.github/workflows/test-release.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Wait for release
-        uses: lewagon/wait-on-check-action@v1.7.0
+        uses: lewagon/wait-on-check-action@96d9100b431964d10e0136aff8b9ccb92470505e # v1.8.0
         with:
           ref: ${{ github.ref }}
           check-name: "Release GHA"
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: wait-for-release
     steps:
-      - uses: releasetools/cli@v0
+      - uses: releasetools/cli@964f2bb77ea50d9c1c9aa70e9cb2e7c19212c8a6 # v0
       - name: Run tests
         shell: bash
         run: |
@@ -47,7 +47,7 @@ jobs:
             echo "No matching version found" >&2
             exit 1
           fi
-      - uses: releasetools/cli@v0
+      - uses: releasetools/cli@964f2bb77ea50d9c1c9aa70e9cb2e7c19212c8a6 # v0
         with:
           version: ${{ env.VERSION }}
       - name: Run Tests
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: wait-for-release
     steps:
-      - uses: releasetools/cli@v0
+      - uses: releasetools/cli@964f2bb77ea50d9c1c9aa70e9cb2e7c19212c8a6 # v0
         env:
           RELEASETOOLS_INSTALL_DIR: /opt/hostedtoolcache/releasetools
           RELEASETOOLS_BINARY_DIR: ${{ runner.temp }}/bin
@@ -97,7 +97,7 @@ jobs:
         run: |
           bash <(curl -sSL "https://github.com/releasetools/cli/releases/download/${{ env.VERSION }}/install.sh")
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Install release tools dependencies
         run: |
@@ -135,7 +135,7 @@ jobs:
             echo "No matching version found" >&2
             exit 1
           fi
-      - uses: releasetools/cli@v0
+      - uses: releasetools/cli@964f2bb77ea50d9c1c9aa70e9cb2e7c19212c8a6 # v0
         with:
           version: ${{ env.VERSION }}
       - name: Run tests