chore: update GitHub Action pins

Pin listed workflow actions to current upstream default-branch SHAs.

Author: nikzen

.github/workflows/docker-pr-dev.yml

@@ -38,25 +38,25 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
 
       - name: Login to Harbor
-        uses: docker/login-action@v3
+        uses: docker/login-action@2ff7bc63ffa51414f77e9cbeea0d3297c1672d2e
         with:
           registry: ${{ env.REGISTRY_HARBOR }}
           username: ${{ vars.REGISTRY_USER }}
           password: ${{ secrets.registry_password }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@2ff7bc63ffa51414f77e9cbeea0d3297c1672d2e
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9
         with:
           images: |
             ${{ env.REGISTRY_GHCR }}/famedly/${{ env.IMAGE_NAME }}
@@ -68,7 +68,7 @@ jobs:
 
       - name: Build and push Docker image (amd64 only)
         id: build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@9e8d01178c767b734d2fef9a000ac2a2137f483f
         with:
           context: .
           push: true

.github/workflows/docs.yaml

@@ -60,7 +60,7 @@ jobs:
           fetch-depth: 0
 
       - name: Caching
-        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
+        uses: Swatinem/rust-cache@65012b490220f477f20ab979e35ae732e6de4e68 # v2.8.0
         with:
           shared-key: "mdbook"
           save-if: ${{ ! startsWith(github.ref, 'gh-readonly-queue/') }}

.github/workflows/famedly-tests.yml

@@ -60,7 +60,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Poetry
-        uses: matrix-org/setup-python-poetry@v2
+        uses: matrix-org/setup-python-poetry@1297526d8f92f6852ff499827bc63cbcf265caba
         with:
           poetry-version: "2.2.1"
           python-version: "3.13"
@@ -83,7 +83,7 @@ jobs:
       - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
 
       - name: Setup Poetry
-        uses: matrix-org/setup-python-poetry@v2
+        uses: matrix-org/setup-python-poetry@1297526d8f92f6852ff499827bc63cbcf265caba
         with:
           # We want to make use of type hints in optional dependencies too.
           extras: all
@@ -256,7 +256,7 @@ jobs:
       - run: poetry run coverage combine
       - run: poetry run coverage xml
       - name: Codecov - Upload coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@ca0a928a4cb3911011e868128a5cd90437c12db1
         with:
           use_oidc: true