Update actions/checkout digest to de0fac2

Author: Gonzalo Diaz

.github/workflows/codeql.yml

@@ -29,7 +29,7 @@ on: # yamllint disable-line rule:truthy
     #        │  │ │ │ │
     #        │  │ │ │ │
     #        *  * * * *
-    - cron: '16 20 * * 0'
+    - cron: "16 20 * * 0"
 
 jobs:
   analyze:
@@ -40,8 +40,7 @@ jobs:
     #   - https://gh.io/using-larger-runners (GitHub.com only)
     # Consider using larger runners or machines with greater resources
     # for possible analysis time improvements.
-    runs-on:
-      ${{ (matrix.language == 'swift' && 'macos-14') || 'ubuntu-24.04' }}
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-14') || 'ubuntu-24.04' }}
     permissions:
       # required for all workflows
       security-events: write
@@ -71,7 +70,7 @@ jobs:
             # yamllint enable rule:line-length
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Check Tools
         run: |

.github/workflows/gitleaks.yml

@@ -1,5 +1,4 @@
 ---
-
 name: gitleaks
 
 on: # yamllint disable-line rule:truthy
@@ -22,7 +21,7 @@ jobs:
     name: gitleaks
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
       - uses: gitleaks/gitleaks-action@v2

.github/workflows/sonarcloud.yml

@@ -16,7 +16,7 @@ jobs:
       # Directory where build-wrapper output will be placed
       BUILD_WRAPPER_OUT_DIR: build
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           # Shallow clones should be disabled for a better relevancy of analysis
           fetch-depth: 0
@@ -47,7 +47,6 @@ jobs:
           export VCPKG_ROOT=/usr/local/share/vcpkg
           build-wrapper-linux-x86-64 --out-dir ${{ env.BUILD_WRAPPER_OUT_DIR }} make build
       # yamllint enable rule:line-length
-
       - name: Run tests to generate coverage statistics
         run: |
           make coverage