ci: Pin everything to commits and don't persist credentials

.github/workflows/archive.yml

@@ -11,7 +11,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@v4
+        # 4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
 
       - name: Install dependencies
         run: |

.github/workflows/build-merge.yml

@@ -16,13 +16,18 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v4
+        # 4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        # 3.10.0
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
 
       - name: Login to ghcr.io
-        uses: docker/login-action@v3
+        # 3.4.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -30,7 +35,8 @@ jobs:
 
       - name: Build and push
         id: docker_build
-        uses: docker/build-push-action@v5
+        # 6.15.0
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4
         with:
           context: .github/actions/merge
           file: .github/actions/merge/Dockerfile

.github/workflows/ci.yml

@@ -12,15 +12,19 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v4
+        # 4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-python@v5
+        # 5.4.0
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38
         with:
           python-version: '3.13'
           cache: 'pip'
 
       - name: Install dependencies
-        run: pip install --user ruff
+        run: pip install --user 'ruff==0.11.0'
 
       - name: Check format
         run: find .github -name *.py -exec ruff format --check {} \;

.github/workflows/external-data-checker.yml

@@ -14,7 +14,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 120
     steps:
-    - uses: actions/checkout@v4
+        # 4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
 
     - uses: ./.github/actions/flatpak-external-data-checker
       env:

.github/workflows/merge.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/merge') }}
     container:
-      image: ghcr.io/flathub/actions/merge:latest
+      image: ghcr.io/flathub/actions/merge:latest@sha256:ebeb5c952d8277b56ac96c72c66205c32d241119d086e9e7fa8848e80df39107
     steps:
       - name: Check if actor is reviewer
         id: check_reviewer

.github/workflows/stale.yml

@@ -10,7 +10,8 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/stale@v9
+      # 9.1.0
+    - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         stale-pr-message: "This PR hasn't received any updates in a year and will be automatically closed in 30 days. If you still plan to work on this please comment or re-open the PR."

.github/workflows/tag-quality-mod-issues.yml

@@ -26,7 +26,8 @@ jobs:
     if: github.event.label.name == 'quality-guidelines' && github.event.issue.state != 'closed'
     steps:
       - name: Find Comment
-        uses: peter-evans/find-comment@v3
+        # 3.1.0
+        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e
         id: fc
         with:
           issue-number: ${{ github.event.issue.number }}
@@ -34,7 +35,8 @@ jobs:
           body-regex: '^Thank you for opening this issue! cc @flathub\/quality-moderation$'
 
       - name: Add comment tagging the team
-        uses: peter-evans/create-or-update-comment@v4
+        # 4.0.0
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043
         with:
           token: ${{ secrets.FLATHUBBOT_TOKEN }}
           comment-id: ${{ steps.fc.outputs.comment-id }}