Pin GitHub Actions to commit SHAs

Pin appleboy/scp-action and appleboy/ssh-action to their full commit
SHAs to prevent tag-based supply chain attacks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: james67

.github/workflows/deploy.yml

@@ -45,7 +45,7 @@ jobs:
         run: CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o wtw ./cmd/wtw/
 
       - name: Copy files to server
-        uses: appleboy/scp-action@v0.1.7
+        uses: appleboy/scp-action@917f8b81dfc1ccd331fef9e2d61bdc6c8be94634 # v0.1.7
         with:
           host: ${{ secrets.DEPLOY_HOST }}
           username: ${{ secrets.DEPLOY_USER }}
@@ -57,7 +57,7 @@ jobs:
 
       - name: Stop service before deploy
         continue-on-error: true
-        uses: appleboy/ssh-action@v1.0.3
+        uses: appleboy/ssh-action@029f5b4aeeeb58fdfe1410a5d17f967dacf36262 # v1.0.3
         with:
           host: ${{ secrets.DEPLOY_HOST }}
           username: ${{ secrets.DEPLOY_USER }}
@@ -66,7 +66,7 @@ jobs:
           script: sudo systemctl stop wtw
 
       - name: Install and restart service
-        uses: appleboy/ssh-action@v1.0.3
+        uses: appleboy/ssh-action@029f5b4aeeeb58fdfe1410a5d17f967dacf36262 # v1.0.3
         with:
           host: ${{ secrets.DEPLOY_HOST }}
           username: ${{ secrets.DEPLOY_USER }}