ci: pin github actions to full-length commit shas

Author: danielroe

.github/workflows/ci.yml

@@ -44,7 +44,7 @@ jobs:
         run: pnpm build
 
       - name: Cache dist
-        uses: actions/cache@v5
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
         with:
           path: packages/*/dist
           key: ubuntu-latest-${{ github.sha }}
@@ -170,7 +170,7 @@ jobs:
         run: pnpm install
 
       - name: Restore dist cache
-        uses: actions/cache@v5
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
         with:
           path: packages/*/dist
           key: ubuntu-latest-${{ github.sha }}

.github/workflows/provenance.yml

@@ -13,7 +13,7 @@ jobs:
   check-provenance:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
       - name: Check provenance downgrades

.github/workflows/reproduire.yml

@@ -11,6 +11,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: Hebilicious/reproduire@4b686ae9cbb72dad60f001d278b6e3b2ce40a9ac # v0.0.9-mp
+      - uses: Hebilicious/reproduire@a4b274773e3d6e8bef547385710473af11f5ec5d # v0.0.9-mp
         with:
           label: needs reproduction