ci: pin github action versions

[Boshen]

No description provided.

[Boshen]

• ci: pin github action versions #7826 👈 (View in Graphite)
• main

---

How to use the Graphite Merge Queue

Add either label to this PR to merge it via the merge queue:

• 0-merge - adds this PR to the back of the merge queue
• hotfix - for urgent hot fixes, skip the queue and merge this PR next

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

[codspeed-hq]

CodSpeed Performance Report

Merging #7826 will not alter performance

_{Comparing 12-13-ci_fix_more_zizmore_warnings (d8c6d04) with main (befb0a5)}

Summary

✅ 29 untouched benchmarks

[Boshen]

https://docs.renovatebot.com/modules/manager/github-actions/ seems like the best approach to version pinning.

[AaronDewes]

In my opinion, pinning to a more exact tag does not provide more security.

Someone manipulating the action could still probably force-push (unless GitHub actions prevents this somehow, but I don't think so).

https://woodruffw.github.io/zizmor/audits/#unpinned-uses

zizmor's pendantic mode requires you to pin to a specific commit. I would recommend doing that instead and set up a tool to automatically bump that commit hash to the latest stable release instead.

Please have a look at the renovate docs, it has support for this too.

[Boshen]

I'm pinning these versions first in preparation for renovate bot to work.