chore: bump and pin actions

.github/workflows/build.yaml

@@ -8,6 +8,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      # Action: https://github.com/actions/checkout/releases/tag/v4.2.2
+      - name: Check out the repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+
       - name: Build the Docker image
         run: docker build . --file Dockerfile

.github/workflows/publish.yaml

@@ -9,26 +9,30 @@ jobs:
     name: Push Docker image to Docker Hub
     runs-on: ubuntu-latest
     steps:
+      # Action: https://github.com/actions/checkout/releases/tag/v4.2.2
       - name: Check out the repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
+      # Action: https://github.com/docker/login-action/releases/tag/v3.4.0
       - name: Log in to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
 
+      # Action: https://github.com/docker/metadata-action/releases/tag/v5.7.0
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804
         with:
           images: junobuild/action
           tags: |
             type=semver,pattern={{major}}
             type=semver,pattern={{version}}
 
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v3
+      # Action: https://github.com/docker/build-push-action/releases/tag/v6.18.0
+      - name: Build and push
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
         with:
           context: .
           file: ./Dockerfile

.github/workflows/test-cli.yaml

@@ -8,13 +8,17 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      # Action: https://github.com/actions/checkout/releases/tag/v4.2.2
+      - name: Check out the repo
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
+      # Action: https://github.com/docker/setup-buildx-action/releases/tag/v3.10.0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2
 
+      # Action: https://github.com/docker/build-push-action/releases/tag/v6.18.0
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
         with:
           context: .
           file: Dockerfile