security: pin GitHub Actions to hashes to resolve Scorecard alerts

Author: hyperpolymath

.github/workflows/comprehensive-quality.yml

@@ -32,7 +32,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
       - name: Secret scanning
-        uses: trufflesecurity/trufflehog@main
+        uses: trufflesecurity/trufflehog@37835157ba6190a612501a35f7959b8eb3009581 # v3.82.13
         continue-on-error: true
       - name: Dependency vulnerabilities
         run: |
@@ -43,7 +43,7 @@ jobs:
             pip install safety && safety check -r requirements.txt || true
           fi
       - name: SAST scan
-        uses: returntocorp/semgrep-action@v1
+        uses: returntocorp/semgrep-action@73f32468d6f519542a17585b5463b2f542475476 # v1.11.0
         continue-on-error: true
 
   # INTEROPERABILITY - API and format compatibility

.github/workflows/release.yml

@@ -32,7 +32,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
 
       - name: Install Rust
-        uses: dtolnay/rust-action@stable
+        uses: dtolnay/rust-action@43388701980327f2ec9d300445d44007802f06c1 # v1.0.0
         with:
           targets: ${{ matrix.target }}
 
@@ -66,7 +66,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
 
       - name: Install Rust
-        uses: dtolnay/rust-action@stable
+        uses: dtolnay/rust-action@43388701980327f2ec9d300445d44007802f06c1 # v1.0.0
         with:
           targets: ${{ matrix.target }}
 
@@ -92,7 +92,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
 
       - name: Install Rust
-        uses: dtolnay/rust-action@stable
+        uses: dtolnay/rust-action@43388701980327f2ec9d300445d44007802f06c1 # v1.0.0
 
       - name: Build
         run: cargo build --release
@@ -117,7 +117,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
 
       - name: Install Gleam
-        uses: erlef/setup-beam@v1
+        uses: erlef/setup-beam@53eca37a5015e5c7075c3d9b4b08705001f35835 # v1.18.2
         with:
           otp-version: '26'
           gleam-version: 'latest'
@@ -153,7 +153,7 @@ jobs:
           sha256sum * > SHA256SUMS.txt
 
       - name: Create Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@c87adaf44f9b5c94295d4615a639679203028d77 # v2.2.1
         with:
           files: release/*
           generate_release_notes: true

.github/workflows/test.yml

@@ -25,7 +25,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Racket
-        uses: Bogdanp/setup-racket@v1.15
+        uses: Bogdanp/setup-racket@67838a16f2122684177c86729eb9cf0438ec677b # v1.15
         with:
           version: ${{ matrix.racket-version }}
           packages: 'rackunit'
@@ -75,7 +75,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Racket
-        uses: Bogdanp/setup-racket@v1.15
+        uses: Bogdanp/setup-racket@67838a16f2122684177c86729eb9cf0438ec677b # v1.15
         with:
           version: 'current'