chore(deps): pin dependencies

.gitea/workflows/cd.yaml

@@ -10,7 +10,7 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
       - name: Increment tag

.gitea/workflows/ci.yaml

@@ -10,7 +10,7 @@ jobs:
       - ubuntu-latest
       - linux_amd64
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - name: Setup Trivy
         uses: ./setup-trivy
         with:
@@ -25,7 +25,7 @@ jobs:
       - ubuntu-latest
       - linux_amd64
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - uses: ./setup-trivy
         with:
           version: v0.66.0

.gitea/workflows/prerelease.yaml

@@ -8,7 +8,7 @@ jobs:
     name: Prerelease
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
       - name: Increment tag

setup-db/action.yaml

@@ -19,7 +19,7 @@ runs:
       run: |
         echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
     - id: restore-db
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: ${{ inputs.cache-dir }}
         key: trivy-db-${{ steps.current-date.outputs.current-date }}

setup-trivy/action.yaml

@@ -20,7 +20,7 @@ runs:
   steps:
     - name: Cache Trivy binary
       id: cache-trivy
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: /usr/local/bin/trivy
         key: trivy-${{ inputs.version }}-${{ inputs.architecture }}