fix(security): pin GitHub Actions to commit SHA

Author: reearth-app[bot]

.github/workflows/ci.yml

@@ -10,14 +10,14 @@ jobs:
     name: Lint and Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: lts/*
       - name: Get yarn cache directory path
         id: yarn-cache-dir-path
         run: echo "path=$(yarn cache dir)" >> $GITHUB_OUTPUT
-      - uses: actions/cache@v5
+      - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: ${{ steps.yarn-cache-dir-path.outputs.path }}
           key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}

.github/workflows/npm_release.yml

@@ -21,16 +21,16 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           token: ${{ secrets.PAT }}
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: lts/*
       - name: Get yarn cache directory path
         id: yarn-cache-dir-path
         run: echo "path=$(yarn cache dir)" >> $GITHUB_OUTPUT
-      - uses: actions/cache@v5
+      - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: ${{ steps.yarn-cache-dir-path.outputs.path }}
           key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
@@ -53,7 +53,7 @@ jobs:
           git push --tags
 
       - name: Release to NPM
-        uses: JS-DevTools/npm-publish@v4
+        uses: JS-DevTools/npm-publish@0fd2f4369c5d6bcfcde6091a7c527d810b9b5c3f # v4
         with:
           token: ${{ secrets.NPM_TOKEN }}
           tag: ${{ inputs.tag }}

.github/workflows/pr_title.yml

@@ -18,10 +18,10 @@ jobs:
   pr_title:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v4
+      - uses: actions/labeler@ac9175f8a1f3625fd0d4fb234536d26811351594 # v4
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
-      - uses: amannn/action-semantic-pull-request@v6
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/release_alpha.yml

@@ -42,10 +42,10 @@ jobs:
       github.event.pull_request.base.ref == 'alpha' &&
       startsWith(github.event.pull_request.head.ref, 'release/alpha-')
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.event.pull_request.merge_commit_sha }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           # Trusted Publishing requires Node >=22.14 and npm >=11.5.1. Pin a
           # concrete >=22.14 version so the floor can't regress via runner

.github/workflows/release_alpha_prepare.yml

@@ -24,8 +24,8 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/alpha'
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22.14.0
       - name: Set up git user

.github/workflows/release_beta.yml

@@ -9,7 +9,7 @@ jobs:
   release:
     permissions:
       contents: write
-    uses: reearth/core/.github/workflows/npm_release.yml@beta
+    uses: reearth/core/.github/workflows/npm_release.yml@b70d597c18e8346abd10066dfb3f7addd9ed1af3 # beta
     with:
       branch: beta
       tag: beta

.github/workflows/release_latest.yml

@@ -13,7 +13,7 @@ jobs:
   release:
     permissions:
       contents: write
-    uses: reearth/core/.github/workflows/npm_release.yml@beta
+    uses: reearth/core/.github/workflows/npm_release.yml@b70d597c18e8346abd10066dfb3f7addd9ed1af3 # beta
     with:
       branch: main
       tag: latest