ci: pin dependencies

Author: renovate[bot]

.github/workflows/setup-repository.yml

@@ -11,7 +11,7 @@ jobs:
     steps:
       - name: Check if repo is a template repository
         id: checkRepo
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
         with:
           script: |
             const repo = await github.rest.repos.get({
@@ -45,16 +45,16 @@ jobs:
     permissions: write-all
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Create cookiecutter.json
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
         with:
           script: |
             const config = { name: context.repo.repo };
             require('fs').writeFileSync('cookiecutter.json', JSON.stringify(config), { encoding: 'utf-8' });
 
-      - uses: actions/setup-python@v3
+      - uses: actions/setup-python@3542bca2639a428e1796aaa6a2ffef0c0f575566 # v3
         with:
           python-version: '3.x'
 
@@ -87,7 +87,7 @@ jobs:
           rsync -r ./plain/ . && \
           rm -rf ./plain/
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3
         with:
           name: result
           path: |