ci: pin github actions to full-length commit shas

Author: danielroe

.github/workflows/autofix.yml

@@ -27,4 +27,4 @@ jobs:
  - name: 🔠 Lint project (+ fix)
 run: pnpm run lint:fix
 
- - uses: autofix-ci/action@7a166d7532b277f34e16238930461bf77f9d7ed8
+ - uses: autofix-ci/action@7a166d7532b277f34e16238930461bf77f9d7ed8# 7a166d7532b277f34e16238930461bf77f9d7ed8

.github/workflows/bench.yml

@@ -19,7 +19,7 @@ jobs:
 with:
 fetch-depth: 0
  - run: corepack enable
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 #v6
 with:
 node-version: lts/*
 cache: pnpm

.github/workflows/ci.yml

@@ -46,14 +46,14 @@ jobs:
 with:
 fetch-depth: 0
  - run: corepack enable
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
 with:
 node-version: lts/-1
 cache: pnpm
- - uses: oven-sh/setup-bun@v2
+ - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 #v2
 with:
 bun-version: latest
- - uses: denoland/setup-deno@v2
+ - uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb #v2
 with:
 deno-version: 2.6.8
 
@@ -78,7 +78,7 @@ jobs:
 run: pnpm test:unit
 
  - if: matrix.os != 'windows-latest'
-uses: codecov/codecov-action@v5
+uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de #v5
 
 release:
 runs-on: ubuntu-latest

.github/workflows/provenance.yml

@@ -13,7 +13,7 @@ jobs:
 check-provenance:
 runs-on: ubuntu-latest
 steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6
 with:
 fetch-depth: 0
  - name: Check provenance downgrades

.github/workflows/size-comment.yml

@@ -25,7 +25,7 @@ jobs:
 sparse-checkout-cone-mode: false
 
  - name: ⏬ Download artifacts from workflow run
-uses: actions/download-artifact@v7
+uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 #v7
 with:
 github-token: ${{ secrets.GITHUB_TOKEN }}
 run-id: ${{ github.event.workflow_run.id }}
@@ -52,7 +52,7 @@ jobs:
  echo "EOF" >> $GITHUB_OUTPUT
 
  - name: 💬 Post or update comment
-uses: actions/github-script@v8
+uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #v8
 with:
 script: |
  const prNumber = ${{ steps.pr.outputs.result }};

.github/workflows/size.yml

@@ -39,13 +39,13 @@ jobs:
 run: echo "${{ github.event.pull_request.number }}" > pr-number.txt
 
  - name: ⏫ Upload stats.json
-uses: actions/upload-artifact@v6
+uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f #v6
 with:
 name: head-stats
 path: ./packages/*/stats.json
 
  - name: ⏫ Upload PR number
-uses: actions/upload-artifact@v6
+uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f #v6
 with:
 name: pr-number
 path: pr-number.txt
@@ -75,7 +75,7 @@ jobs:
 run: pnpm build
 
  - name: ⏫ Upload stats.json
-uses: actions/upload-artifact@v6
+uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f #v6
 with:
 name: base-stats
 path: ./packages/*/stats.json