chore(deps): pin dependencies

.gitea/workflows/cd.yaml

@@ -48,7 +48,7 @@ jobs:
     if: ${{ needs.check-changes.outputs.changes == 'true' }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
       - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ${{ env.DOCKER_REGISTRY }}

.gitea/workflows/ci.yaml

@@ -15,7 +15,7 @@ jobs:
         with:
           bun-version-file: ".bun-version"
       # only required for cspell compatibility until a mature replacement is available
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 20
       - run: bun install --frozen-lockfile