ci: pin GitHub Actions (with pinact)

Author: philpennock

.github/workflows/pushes.yaml

@@ -28,13 +28,13 @@ jobs:
     steps:
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
 
       - id: setup-go
         name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
           go-version: 'stable'
           check-latest: true

.github/workflows/tags.yaml

@@ -28,7 +28,7 @@ jobs:
 
       - id: checkout
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           # We want to be able to push tag deletions if we reject it
           persist-credentials: true