ci: pin workflow actions for release safety

Author: takemiyamakoto

.github/workflows/branch-flow.yml

@@ -12,7 +12,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Branch flow audit self-test
         run: bash scripts/test-branch-flow-audit.sh

.github/workflows/codecov.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: macOS-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Branch flow audit
         run: |
@@ -58,7 +58,7 @@ jobs:
 
       - name: Upload shared-features delta report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: shared-features-delta-report
           path: build/reports/shared-features-delta-report.json