ci: pin cargo-deny-action and gitleaks-action to immutable SHAs

Author: codex

.github/workflows/cargo-deny.yml

@@ -21,7 +21,7 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
 
       - name: Run cargo-deny
-        uses: EmbarkStudios/cargo-deny-action@v2
+        uses: EmbarkStudios/cargo-deny-action@91bf2b620e09e18d6eb78b92e7861937469acedb # v6
         with:
           rust-version: stable
           manifest-path: ./codex-rs/Cargo.toml

.github/workflows/stage-gates.yml

@@ -140,7 +140,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.1.1
         with:
           fetch-depth: 0
-      - uses: gitleaks/gitleaks-action@v2
+      - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}