Merge pull request #847 from alphagov/pin_gha_actions_to_hashes

[PNP-9961] Pin SHAs for third-party actions

Author: KludgeKML

.github/workflows/ci.yml

@@ -55,7 +55,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
         with:
           bundler-cache: true
 

.github/workflows/pact-verify.yml

@@ -52,7 +52,7 @@ jobs:
         with:
           repository: alphagov/locations-api
           ref: ${{ inputs.ref }}
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
         with:
           bundler-cache: true
       - run: bundle exec rails db:setup