chore: pin actions to hashes

.github/workflows/build_code.yml

@@ -17,11 +17,11 @@ jobs:
         shell: pwsh
     steps:
     - name: Checkout code 👋
-      uses: actions/checkout@v2
+      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
     - name: Install Go 🗳
       uses: ./.github/workflows/composite/bootstrap-go
     - name: Run GoReleaser 🚀
-      uses: goreleaser/goreleaser-action@v2
+      uses: goreleaser/goreleaser-action@ff11ca24a9b39f2d36796d1fbd7a4e39c182630a
       with:
         distribution: goreleaser
         version: latest

.github/workflows/code.yml

@@ -20,13 +20,13 @@ jobs:
         working-directory: ${{ github.workspace }}/src
     steps:
     - name: Install Go
-      uses: actions/setup-go@v2
+      uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f
       with:
         go-version: 1.18
     - name: Checkout code
-      uses: actions/checkout@v2
+      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
     - name: Golang CI
-      uses: golangci/golangci-lint-action@v2
+      uses: golangci/golangci-lint-action@537aa1903e5d359d0b27dbc19ddd22c5087f3fbc
       with:
         version: latest
         working-directory: src

.github/workflows/codeql.yml

@@ -20,16 +20,16 @@ jobs:
         working-directory: ${{ github.workspace }}/src
     steps:
     - name: Install Go
-      uses: actions/setup-go@v2
+      uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f
       with:
         go-version: 1.18
     - name: Checkout code
-      uses: actions/checkout@v2
+      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v1
       with:
         languages: go
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@9ba4d500aa0261992135290a8c8eff47a4bb2ecb
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@9ba4d500aa0261992135290a8c8eff47a4bb2ecb

.github/workflows/commits.yml

@@ -6,9 +6,9 @@ jobs:
   commitlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
         with:
           fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@v2
+      - uses: wagoid/commitlint-github-action@2d572ed5ea8b369af534fa21eea186a7eef07cda
         with:
           configFile: './.commitlintrc.yml'

.github/workflows/composite/bootstrap-go/action.yml

@@ -8,7 +8,7 @@ runs:
   using: "composite"
   steps:
     - name: Install Go
-      uses: actions/setup-go@v2
+      uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f
       with:
         go-version: 1.19
     - name: Override Go ♻️

.github/workflows/docs.yml

@@ -13,22 +13,22 @@ jobs:
     runs-on: ubuntu-latest
     name: Build and Deploy
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
         with:
           submodules: true
           persist-credentials: false
       - name: Install Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f
         with:
           go-version: 1.18
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@2fddd8803e2f5c9604345a0b591c3020ee971a93
         with:
           node-version: 17.6.0
         # Create Kind cluster to have a Kubernetes context for cloud-native-azure theme
         # Images are defined on every Kind release
         # See https://github.com/kubernetes-sigs/kind/releases
       - name: Create k8s v1.23 Kind Cluster
-        uses: helm/kind-action@v1.2.0
+        uses: helm/kind-action@d08cf6ff1575077dee99962540d77ce91c62387d
         with:
           node_image: kindest/node:v1.23.4@sha256:0e34f0d0fd448aa2f2819cfd74e99fe5793a6e4938b328f657c8e3f81ee0dfb9
           cluster_name: posh
@@ -55,7 +55,7 @@ jobs:
           cd ..
       - name: Build Docs And Deploy 🚀
         id: builddeploy
-        uses: Azure/static-web-apps-deploy@v1
+        uses: Azure/static-web-apps-deploy@1a947af9992250f3bc2e68ad0754c0b0c11566c9
         with:
           azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_ASHY_MEADOW_063E9BA03 }}
           repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for Github integrations (i.e. PR comments)

.github/workflows/edit_rights.yml

@@ -16,7 +16,7 @@ jobs:
   notify-when-maintainers-cannot-edit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v5
+      - uses: actions/github-script@c713e510dbd7d213d92d41b7a7805a986f4c5c66
         with:
           github-token: ${{ secrets.GH_PAT }}
           script: |

.github/workflows/gomod.yml

@@ -10,11 +10,11 @@ jobs:
         working-directory: ${{ github.workspace }}/src
     steps:
     - name: Install Go
-      uses: actions/setup-go@v2
+      uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f
       with:
         go-version: 1.18
     - name: Checkout code
-      uses: actions/checkout@v2
+      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
     - name: Check for unused dependencies
       run: |
         go mod tidy

.github/workflows/homebrew.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Notify Homebrew Repo 🙋🏾‍♀️
-      uses: actions/github-script@v5
+      uses: actions/github-script@c713e510dbd7d213d92d41b7a7805a986f4c5c66
       with:
         github-token: ${{ secrets.GH_PAT }}
         script: |

.github/workflows/inno.yml

@@ -15,7 +15,7 @@ jobs:
         working-directory: ${{ github.workspace }}/packages/inno
     steps:
     - name: Checkout code 👋
-      uses: actions/checkout@v2
+      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
     - name: Build installer 📦
       id: build
       env:
@@ -30,7 +30,7 @@ jobs:
       env:
         GITHUB_TOKEN: ${{ github.token }}
     - name: Upload artifacts 🆙
-      uses: actions/github-script@v5
+      uses: actions/github-script@c713e510dbd7d213d92d41b7a7805a986f4c5c66
       with:
         github-token: ${{secrets.GITHUB_TOKEN}}
         script: |
@@ -56,7 +56,7 @@ jobs:
     needs: publish
     steps:
     - name: Notify Winget Build 🙋🏾‍♀️
-      uses: actions/github-script@v5
+      uses: actions/github-script@c713e510dbd7d213d92d41b7a7805a986f4c5c66
       with:
         github-token: ${{ secrets.GH_PAT }}
         script: |
@@ -68,7 +68,7 @@ jobs:
             inputs: {"version": process.env.GITHUB_REF.replace('refs/tags/v', '')}
           })
     - name: Notify Windows Store Build 👋
-      uses: actions/github-script@v5
+      uses: actions/github-script@c713e510dbd7d213d92d41b7a7805a986f4c5c66
       with:
         github-token: ${{ secrets.GH_PAT }}
         script: |

.github/workflows/markdown.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@v2
+      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
     - name: Lint files
       uses: articulate/actions-markdownlint@v1
       with:

.github/workflows/release.yml

@@ -19,7 +19,7 @@ jobs:
       skipped: ${{ steps.changelog.outputs.skipped }}
     steps:
       - name: Checkout code 👋
-        uses: actions/checkout@v2
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - name: Create changelog ✍️
         id: changelog
         uses: TriPSs/conventional-changelog-action@v3
@@ -41,13 +41,13 @@ jobs:
         working-directory: ${{ github.workspace }}/src
     steps:
       - name: Checkout code 👋
-        uses: actions/checkout@v2
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - name: Install Go 🗳
         uses: ./.github/workflows/composite/bootstrap-go
       - name: Tag HEAD 😸
         run: git tag ${{ needs.changelog.outputs.tag }}
       - name: Install cosign 🔑
-        uses: sigstore/cosign-installer@main
+        uses: sigstore/cosign-installer@f3c664df7af409cb4873aa5068053ba9d61a57b6
         with:
           cosign-release: 'v1.4.0'
       - name: Private Key 🔐
@@ -57,7 +57,7 @@ jobs:
         env:
           COSIGN_KEY: ${{secrets.COSIGN_KEY}}
       - name: Run GoReleaser 🚀
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@ff11ca24a9b39f2d36796d1fbd7a4e39c182630a
         with:
           distribution: goreleaser
           version: latest
@@ -82,7 +82,7 @@ jobs:
           }
         shell: pwsh
       - name: Release 🎓
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@1e07f4398721186383de40550babbdf2b84acfc5
         with:
           tag_name: ${{ needs.changelog.outputs.tag }}
           body: ${{ needs.changelog.outputs.body }}

.github/workflows/scoop.yml

@@ -12,10 +12,10 @@ jobs:
         working-directory: ${{ github.workspace }}/packages/scoop
     steps:
     - name: Checkout code 👋
-      uses: actions/checkout@v2
+      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
     - name: Get release ⬇️
       id: get_release
-      uses: bruceadams/get-release@v1.2.3
+      uses: bruceadams/get-release@3a8733307b85cd96d52772b037617bd63d99522e
       env:
         GITHUB_TOKEN: ${{ github.token }}
     - name: Update Template ✍️
@@ -23,7 +23,7 @@ jobs:
         $version = $env:GITHUB_REF.TrimStart("refs/tags/v")
         ./build.ps1 -Version $version
     - name: Upload artifacts 🆙
-      uses: actions/github-script@v5
+      uses: actions/github-script@c713e510dbd7d213d92d41b7a7805a986f4c5c66
       with:
         github-token: ${{secrets.GITHUB_TOKEN}}
         script: |

.github/workflows/winget.yml

@@ -17,7 +17,7 @@ jobs:
       WINGETCREATE_TOKEN: ${{ secrets.WINGETCREATE_TOKEN }}
     steps:
     - name: Checkout code 👋
-      uses: actions/checkout@v2
+      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
     - name: Create manifest and submit PR 📦
       run: |
         ./build.ps1 -Version "${{ github.event.inputs.version }}" -Token $env:WINGETCREATE_TOKEN