Merge pull request #328 from step-security-bot/chore/GHA-110904-stepsecurity-remediation

[StepSecurity] ci: Harden GitHub Actions

Author: tolgaozen

.github/workflows/protos.yml

@@ -28,7 +28,7 @@ jobs:
 
        # Setup Buf CLI - will pull proto from buf.build/permifyco/permify
        - name: Setup Buf
-         uses: bufbuild/buf-action@v1
+         uses: bufbuild/buf-action@8f4a1456a0ab6a1eb80ba68e53832e6fcfacc16c # v1.3.0
          with:
            setup_only: true
            github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -52,7 +52,7 @@ jobs:
        # Create Pull Request only if there are changes
        - name: Create Pull Request
          if: steps.verify-changes.outputs.has_changes == 'true'
-         uses: peter-evans/create-pull-request@v7.0.8
+         uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
          with:
            token: ${{ secrets.GITHUB_TOKEN }}
            commit-message: "chore(proto): update generated SDK with latest Permify definitions"