chore: pin workflow actions to commit SHAs (#178)

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: airslice

.github/workflows/e2e.yml

@@ -72,7 +72,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Slack Notification
-        uses: Gamesight/slack-workflow-status@master
+        uses: Gamesight/slack-workflow-status@2e709ce51fd47f02b7221db8547e6e6f49f81f1d # master
         if: always()
         with:
           repo_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -38,7 +38,7 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
       - id: changelog
         name: Generate CHANGELOG
-        uses: reearth/changelog-action@main
+        uses: reearth/changelog-action@86cb9d7a3727f3cb6afe36a1536fad61e9775287 # main
         with:
           version: ${{ github.event.inputs.version }}
           repo: ${{ github.repository }}