Pin dependencies

.github/workflows/upgrade-dependencies.yml

@@ -76,7 +76,7 @@ jobs:
     steps:
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
         with:
           ref: ${{ inputs.ref }}
           submodules: recursive
@@ -85,7 +85,7 @@ jobs:
       # For PHP.
       - name: Setup PHP
         if: inputs.composer_dirs != ''
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2
         with:
           php-version: ${{ inputs.php_version }}
           tools: composer:v2
@@ -98,7 +98,7 @@ jobs:
 
       - name: Cache composer dependencies
         if: inputs.composer_dirs != ''
-        uses: actions/cache@v5
+        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -123,7 +123,7 @@ jobs:
 
       - name: Setup Node.js
         if: inputs.yarn_dirs != ''
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
         with:
           node-version: ${{ inputs.node_version }}
           cache: yarn
@@ -157,7 +157,7 @@ jobs:
 
       - name: Cache cargo
         if: inputs.cargo_dirs != ''
-        uses: actions/cache@v5
+        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
           path: |
             ~/.cargo/registry
@@ -180,7 +180,7 @@ jobs:
       # For Go.
       - name: Setup Go
         if: inputs.go_dirs != ''
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
         with:
           go-version: ${{ inputs.go_version }}
           cache-dependency-path: '**/go.sum'
@@ -217,7 +217,7 @@ jobs:
       # Create the PR using the separate token.
       - name: Create PR
         id: cpr
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8
         with:
           token: ${{ secrets.RINUS_GITHUB_TOKEN }}
           author: 'Rinus <info@angrybytes.com>'