chore: pin GitHub Actions to full-length commit SHAs

.github/actions/install-dependencies/action.yml

@@ -15,7 +15,7 @@ runs:
       shell: bash
 
     - name: Check dependency cache
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       id: cache_dependencies
       with:
         path: ${{ env.CACHED_DEPENDENCY_PATHS }}

.github/actions/install-playwright/action.yml

@@ -18,7 +18,7 @@ runs:
       working-directory: ${{ inputs.cwd }}
 
     - name: Restore cached playwright binaries
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       id: playwright-cache
       with:
         path: |
@@ -43,7 +43,7 @@ runs:
 
     # Only store cache on develop branch
     - name: Store cached playwright binaries
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
       with:
         path: |

.github/actions/restore-cache/action.yml

@@ -11,13 +11,13 @@ runs:
   steps:
     - name: Check dependency cache
       id: dep-cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: ${{ env.CACHED_DEPENDENCY_PATHS }}
         key: ${{ inputs.dependency_cache_key }}
 
     - name: Restore build artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: build-output
 

.github/workflows/auto-release.yml

@@ -24,13 +24,13 @@ jobs:
           app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
           private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           token: ${{ steps.token.outputs.token }}
           fetch-depth: 0
 
       # https://github.com/actions-ecosystem/action-regex-match
-      - uses: actions-ecosystem/action-regex-match@v2
+      - uses: actions-ecosystem/action-regex-match@9e6c4fb3d5e898f505be7a1fb6e7b0a278f6665b # v2
         id: version-regex
         with:
           # Parse version from head branch
@@ -46,7 +46,7 @@ jobs:
           echo "version=$version" >> $GITHUB_OUTPUT
 
       - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version-file: 'package.json'