chore: Pin dependencies

.github/workflows/auto-request-review.yml

@@ -13,6 +13,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Request reviews based on configuration
-        uses: necojackarc/auto-request-review@v0.13.0
+        uses: necojackarc/auto-request-review@e89da1a8cd7c8c16d9de9c6e763290b6b0e3d424 # v0.13.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ci.yml

@@ -24,10 +24,10 @@ jobs:
             calculate-code-coverage: true
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
     - name: Set up PHP with PECL extension
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@9e72090525849c5e82e596468b86eb55e9cc5401 # v2
       with:
         php-version: ${{ matrix.php }}
         coverage: xdebug
@@ -39,7 +39,7 @@ jobs:
 
     - name: Cache Composer packages
       id: composer-cache
-      uses: actions/cache@v4
+      uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
       with:
         path: vendor
         key: ${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}
@@ -71,7 +71,7 @@ jobs:
 
     - name: Upload coverage results to Coveralls
       if: matrix.calculate-code-coverage == true
-      uses: coverallsapp/github-action@v2
+      uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         fail-on-error: false

.github/workflows/release-please.yaml

@@ -17,7 +17,7 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@a02a34c4d625f9be7cb89156071d8567266a2445 # v4
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           config-file: .github/actions/release-please/config.json

.github/workflows/sloth.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Sloth
-        uses: lendable/sloth@0.2.0
+        uses: lendable/sloth@e1fd9a2df2549f6e64188f274bc5d3b39d7842ed # 0.2.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           interval: 10