Merge pull request #625 from gameroman/pin-sha

chore(security): update github actions and pin to commits sha

Author: fitztrev

.github/workflows/lint.yml

@@ -20,11 +20,11 @@ jobs:
       run:
         working-directory: doc
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 24
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
         with:
           run_install: true
           package_json_file: doc/package.json

.github/workflows/publish.yml

@@ -22,8 +22,8 @@ jobs:
       run:
         working-directory: ./types
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 24
           registry-url: 'https://registry.npmjs.org'
@@ -44,7 +44,7 @@ jobs:
           npm version patch --no-git-tag-version
           sed -i 's/version: .*/version: '"$(node -p "require('./package.json').version")"'/' ../doc/specs/lichess-api.yaml
           npm publish --provenance
-      - uses: stefanzweifel/git-auto-commit-action@v5
+      - uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
         if: steps.check_changes.outputs.changed_files != ''
         with:
           commit_message: 'Update API version'
@@ -60,17 +60,17 @@ jobs:
       run:
         working-directory: doc
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: master
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
         with:
           package_json_file: doc/package.json
           run_install: true
       - run: pnpm build --base=/api
-      - uses: actions/configure-pages@v3
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
+      - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
         with:
           path: doc/dist
-      - uses: actions/deploy-pages@v4
+      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
         id: deployment