github: Pin actions and tools to specific version (#1047)

Author: penberg

.github/workflows/go.yml

@@ -25,13 +25,13 @@ jobs:
     needs: authorize
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
         with:
           ref: ${{ github.event.pull_request.head.sha || github.ref }}
           #ref: "refs/pull/${{ github.event.number }}/merge" # THIS IS INSECURE
 
       - name: Setup Golang with cache
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v5.5.0
         with:
           go-version-file: go.mod
           cache: false
@@ -56,7 +56,7 @@ jobs:
         run: go vet -vettool=${HOME}/go/bin/sqlclosecheck ./...
 
       - name: Staticcheck
-        uses: dominikh/staticcheck-action@v1
+        uses: dominikh/staticcheck-action@v1.4.1
         with:
           version: "2025.1.1"
           build-tags: "preview"

.github/workflows/goreleaser.yml

@@ -13,26 +13,26 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
         with:
           fetch-depth: 0
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v5.5.0
         with:
           go-version: "1.21"
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v4
+        uses: goreleaser/goreleaser-action@v4.6.0
         with:
           distribution: goreleaser
-          version: latest
+          version: v2.12.7
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.ACCESS_TOKEN_TO_TAP }}
       - name: Run GoReleaser to turso-cli repo
-        uses: goreleaser/goreleaser-action@v4
+        uses: goreleaser/goreleaser-action@v4.6.0
         with:
           distribution: goreleaser
-          version: latest
+          version: v2.12.7
           args: release --clean --config .goreleaser-self.yaml
         env:
           GITHUB_TOKEN: ${{ secrets.ACCESS_TOKEN_TO_SELF }}
@@ -43,7 +43,7 @@ jobs:
       - name: Echo
         run: echo ${{ steps.get_version.outputs.VERSION }}
       - name: Update Turso backoffice
-        uses: fjogeleit/http-request-action@v1
+        uses: fjogeleit/http-request-action@v1.16.5
         with:
             url: 'https://api.turso.tech/releases'
             method: 'POST'