Merge pull request #8054 from scratchfoundation/renovate/pin-dependencies

chore(deps): pin dependencies

.github/workflows/ci-cd.yml

@@ -40,8 +40,8 @@ jobs:
       # See https://github.com/scratchfoundation/scratch-www/settings/variables/actions
       SCRATCH_SHOULD_DEPLOY: ${{ vars.SCRATCH_ENV != '' }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4
         with:
           cache: 'npm'
           node-version-file: '.nvmrc'
@@ -140,6 +140,6 @@ jobs:
         run: tar -czvf build.tgz build
       - name: upload artifact
         if: ${{ env.SCRATCH_SHOULD_DEPLOY == 'true' }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4
         with:
           path: build.tgz

.github/workflows/prepare-release.yml

@@ -16,7 +16,7 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Checkout master
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           fetch-depth: 0
           ref: master
@@ -32,7 +32,7 @@ jobs:
           git merge --no-ff origin/develop
           git push --set-upstream origin ${{ steps.vars.outputs.branch }}
       - name: Develop PR
-        uses: repo-sync/pull-request@v2
+        uses: repo-sync/pull-request@7e79a9f5dc3ad0ce53138f01df2fad14a04831c5 # v2
         with:
           source_branch: ${{ steps.vars.outputs.branch }}
           destination_branch: develop
@@ -40,7 +40,7 @@ jobs:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           pr_allow_empty: true
       - name: Master PR
-        uses: repo-sync/pull-request@v2
+        uses: repo-sync/pull-request@7e79a9f5dc3ad0ce53138f01df2fad14a04831c5 # v2
         with:
           source_branch: ${{ steps.vars.outputs.branch }}
           destination_branch: master