Pin GH actions to commit hashes

Author: cowtowncoder

.github/workflows/coverage-comment.yml

@@ -15,14 +15,14 @@ jobs:
       github.event.workflow_run.conclusion == 'success'
     steps:
     - name: Download PR comment artifact
-      uses: dawidd6/action-download-artifact@v21
+      uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
       with:
         workflow: main.yml
         run_id: ${{ github.event.workflow_run.id }}
         name: pr-coverage-comment
         path: pr-coverage-comment/
     - name: Post or update PR comment
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
           const fs = require('fs');

.github/workflows/main.yml

@@ -63,14 +63,14 @@ jobs:
         flags: unittests
     - name: Upload coverage report as artifact
       if: ${{ matrix.release_build && github.event_name != 'pull_request' && github.repository == 'FasterXML/jackson-dataformats-binary' }}
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: jacoco-report
         path: '**/target/site/jacoco/jacoco.csv'
         retention-days: 30
     - name: Download base branch coverage
       if: ${{ matrix.release_build && github.event_name == 'pull_request' }}
-      uses: dawidd6/action-download-artifact@v21
+      uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
       continue-on-error: true
       with:
         workflow: main.yml
@@ -154,7 +154,7 @@ jobs:
         echo "${{ github.event.pull_request.number }}" > pr-number.txt
     - name: Upload PR comment artifact
       if: ${{ matrix.release_build && github.event_name == 'pull_request' }}
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: pr-coverage-comment
         path: |