ci: pin github actions to full-length commit shas

Author: danielroe

.github/workflows/ci.yml

@@ -15,9 +15,9 @@ jobs:
 runs-on: ubuntu-latest
 
 steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6
  - run: corepack enable
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 #v6
 with:
 node-version: lts/*
 cache: 'pnpm'
@@ -39,9 +39,9 @@ jobs:
 runs-on: ${{ matrix.os }}
 
 steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6
  - run: corepack enable
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 #v6
 with:
 node-version: lts/-1
 cache: 'pnpm'
@@ -66,6 +66,6 @@ jobs:
 
  - name: 🟩 Coverage
 if: matrix.os != 'windows-latest'
-uses: codecov/codecov-action@v5
+uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de #v5
 env:
 CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/provenance.yml

@@ -13,7 +13,7 @@ jobs:
 check-provenance:
 runs-on: ubuntu-latest
 steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6
 with:
 fetch-depth: 0
  - name: Check provenance downgrades

.github/workflows/release.yml

@@ -13,9 +13,9 @@ jobs:
 release:
 runs-on: ubuntu-latest
 steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6
  - run: corepack enable
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 #v6
 with:
 node-version: lts/*
 cache: 'pnpm'