fix(ci): pin actions to SHAs, scope commitlint, remove Qlty

Author: TaduJR

.github/workflows/build.yml

@@ -1,21 +1,16 @@
 name: build
 on: [push, pull_request]
 
-permissions: {}
-
 jobs:
   build:
-    permissions:
-      id-token: write
-      contents: read
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Use Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           cache: yarn
           node-version-file: .nvmrc
@@ -28,9 +23,3 @@ jobs:
 
       - name: Run Tests
         run: yarn test:coverage
-
-      - name: Upload coverage to Qlty
-        uses: qltysh/qlty-action/coverage@v2
-        with:
-          oidc: true
-          files: coverage/lcov.info

.github/workflows/commitlint.yml

@@ -7,12 +7,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           fetch-depth: 0
 
       - name: Use Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           cache: yarn
           node-version-file: .nvmrc
@@ -21,4 +21,9 @@ jobs:
         run: yarn
 
       - name: Lint commit message
-        run: yarn commitlint --from=HEAD~1
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            yarn commitlint --from=${{ github.event.pull_request.base.sha }} --to=${{ github.event.pull_request.head.sha }}
+          else
+            yarn commitlint --from=HEAD~1
+          fi

.github/workflows/main.yml

@@ -5,7 +5,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Autoclose issues that did not follow issue template
-        uses: roots/issue-closer@v1.2
+        uses: roots/issue-closer@fec85f2a845cd6cf33eda6e6a4c93026e71f86d1 # v1.2
         with:
           repo-token: ${{ secrets.GH_TOKEN }}
           issue-close-message: "@${issue.user.login} this issue was automatically closed because it did not follow one of the available issue templates. See [here](https://github.com/lawnstarter/react-native-picker-select/issues/new/choose) for available options."

.github/workflows/release-please.yml

@@ -12,7 +12,7 @@ jobs:
 
     steps:
       - name: Release Please
-        uses: google-github-actions/release-please-action@v4
+        uses: google-github-actions/release-please-action@e4dc86ba9405554aeba3c6bb2d169500e7d3b4ee # v4
         id: release
         with:
           token: ${{ secrets.GH_TOKEN }}
@@ -24,10 +24,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Use Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           registry-url: https://registry.npmjs.org