Pin dependencies

.github/actions/tool-setup/action.yml

@@ -81,7 +81,7 @@ runs:
         version: ${{ steps.versions.outputs.pnpm-version }}
     - name: Setup Node
       if: steps.versions.outputs.node-version != 'false'
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       with:
         # Prefix the version with a caret as otherwise actions/setup-node will waste API calls finding where to download the exact version.
         node-version: ^${{ steps.versions.outputs.node-version }}

.github/files/gh-autorelease/workflows/autorelease.yml

@@ -23,7 +23,7 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Create release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/files/gh-autotagger/workflows/autotagger.yml

@@ -25,7 +25,7 @@ jobs:
             exit 1
           fi
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           # We want to potentially trigger "tag" events, but the default GITHUB_TOKEN
           # explicitly does not trigger events.

.github/files/gh-npmjs-autopublisher/workflows/npmjs-autopublisher.yml

@@ -15,9 +15,9 @@ jobs:
     name: Publish
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           # NPM version shouldn't matter, just use the LTS.
           node-version: 'lts/*'

.github/files/gh-wp-svn-autopublish/workflows/wp-svn-autopublish.yml

@@ -38,7 +38,7 @@ jobs:
       - name: Install svn
         run: command -v svn || sudo apt-get install -y subversion
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           path: src
 

.github/workflows/renovate.yml

@@ -34,7 +34,7 @@ jobs:
     name: Renovate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           path: monorepo
       - env: