Harden GitHub workflows

Author: samdark

.github/workflows/build.yml

@@ -26,7 +26,7 @@ on:
 
 jobs:
   codeception:
-    uses: yiisoft/yii2-actions/.github/workflows/codeception.yml@master
+    uses: yiisoft/yii2-actions/.github/workflows/codeception.yml@161a59a5e7d9c5b650c4a132f6e9292bacfcb5cc
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     with:

.github/workflows/docker.yml

@@ -30,7 +30,9 @@ jobs:
 
     steps:
       - name: Checkout.
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
 
       - name: Build and start containers.
         run: docker compose up -d --build --wait

.github/workflows/linter.yml

@@ -26,4 +26,4 @@ on:
 
 jobs:
   phpcs:
-    uses: yiisoft/yii2-actions/.github/workflows/linter.yml@master
+    uses: yiisoft/yii2-actions/.github/workflows/linter.yml@161a59a5e7d9c5b650c4a132f6e9292bacfcb5cc

.github/workflows/static.yml

@@ -26,6 +26,6 @@ on:
 
 jobs:
   phpstan:
-    uses: yiisoft/yii2-actions/.github/workflows/phpstan.yml@master
+    uses: yiisoft/yii2-actions/.github/workflows/phpstan.yml@161a59a5e7d9c5b650c4a132f6e9292bacfcb5cc
     with:
       hook: vendor/bin/codecept build