Merge pull request #2 from RevenueCat/security/pin-actions-to-sha

security: pin GitHub Actions to SHA hashes

Author: alfondotnet

.github/workflows/build.yml

@@ -21,7 +21,7 @@ jobs:
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
 
       - name: Run Spotless
         run: ./gradlew spotlessCheck
@@ -40,7 +40,7 @@ jobs:
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
 
       - name: Build Android
         run: ./gradlew :composeApp:assembleDebug --stacktrace
@@ -65,7 +65,7 @@ jobs:
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
 
       - name: Build iOS Framework
         run: ./gradlew :composeApp:compileKotlinIosSimulatorArm64 --stacktrace
@@ -84,7 +84,7 @@ jobs:
           java-version: 17
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
 
       - name: Run unit tests
         run: ./gradlew testDebugUnitTest --stacktrace