Pin dependencies (#564)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/workflows/ci.yml

@@ -18,12 +18,12 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4.2.2
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         show-progress: false
 
     - name: Setup Node.js with npm
-      uses: actions/setup-node@v4.4.0
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         check-latest: true
         node-version: ${{ env.NODE_JS_VERSION }}
@@ -41,7 +41,7 @@ jobs:
       run: npm run-script build --no-progress
 
     - name: Upload ASF-WebConfigGenerator
-      uses: actions/upload-artifact@v4.6.2
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         if-no-files-found: error
         name: ${{ matrix.os }}_ASF-WebConfigGenerator

.github/workflows/crowdin-ci.yml

@@ -14,12 +14,12 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4.2.2
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         show-progress: false
 
     - name: Upload latest strings for translation on Crowdin
-      uses: crowdin/github-action@v2.9.0
+      uses: crowdin/github-action@9fd07c1c5b36b15f082d1d860dc399f16f849bd7 # v2.9.0
       with:
         crowdin_branch_name: main
         config: '.github/crowdin.yml'

.github/workflows/lock-threads.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Lock inactive threads
-        uses: dessant/lock-threads@v5.0.1
+        uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # v5.0.1
         with:
           discussion-inactive-days: 90
           issue-inactive-days: 30

.github/workflows/release.yml

@@ -18,13 +18,13 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4.2.2
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         show-progress: false
         token: ${{ secrets.ARCHIBOT_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
 
     - name: Setup Node.js with npm
-      uses: actions/setup-node@v4.4.0
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         check-latest: true
         node-version: ${{ env.NODE_JS_VERSION }}
@@ -42,7 +42,7 @@ jobs:
       run: npm run-script build --no-progress
 
     - name: Import GPG key
-      uses: crazy-max/ghaction-import-gpg@v6.3.0
+      uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0
       with:
         gpg_private_key: ${{ secrets.ARCHIBOT_GPG_PRIVATE_KEY }}
         git_user_signingkey: true

.github/workflows/translations.yml

@@ -15,13 +15,13 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4.2.2
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         show-progress: false
         token: ${{ secrets.ARCHIBOT_GITHUB_TOKEN }}
 
     - name: Download latest translations from Crowdin
-      uses: crowdin/github-action@v2.9.0
+      uses: crowdin/github-action@9fd07c1c5b36b15f082d1d860dc399f16f849bd7 # v2.9.0
       with:
         upload_sources: false
         download_translations: true
@@ -33,7 +33,7 @@ jobs:
         token: ${{ secrets.ASF_CROWDIN_API_TOKEN }}
 
     - name: Import GPG key
-      uses: crazy-max/ghaction-import-gpg@v6.3.0
+      uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0
       with:
         gpg_private_key: ${{ secrets.ARCHIBOT_GPG_PRIVATE_KEY }}
         git_user_signingkey: true