chore: pin actions

Author: thymikee

.github/workflows/main.yml

@@ -10,10 +10,10 @@ jobs:
   build-simulator:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           cache: 'npm'
 

README.md

@@ -26,10 +26,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Build Android
-        uses: callstackincubator/android@v2
+        uses: callstackincubator/android@v2 # replace with latest commit hash
         with:
           variant: 'debug' # or else
           github-token: ${{ secrets.GITHUB_TOKEN }}

action.yml

@@ -149,15 +149,15 @@ runs:
 
     - name: Install Java
       if: ${{ !env.ARTIFACT_URL }}
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
       with:
         java-version: 17
         distribution: adopt
         cache: gradle
 
     - name: Validate Gradle wrapper
       if: ${{ inputs.validate-gradle-wrapper == 'true' && !env.ARTIFACT_URL }}
-      uses: gradle/actions/wrapper-validation@v4
+      uses: gradle/actions/wrapper-validation@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1
 
     - name: Create local gradle.properties
       if: ${{ !env.ARTIFACT_URL && inputs.sign }}
@@ -237,7 +237,7 @@ runs:
     - name: Upload Artifact to GitHub
       id: upload-artifact
       if: ${{ env.PROVIDER_NAME == 'GitHub' && (!env.ARTIFACT_URL || (inputs.re-sign == 'true' && github.event_name == 'pull_request')) }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: ${{ env.ARTIFACT_NAME }}
         path: ${{ env.ARTIFACT_PATH }}