Use immutable action refs only

Author: roryabraham

.github/actions/composite/setupNode/action.yml

@@ -19,7 +19,8 @@ runs:
       shell: bash
       run: jq 'del(.version, .packages[""].version)' package-lock.json > normalized-package-lock.json
 
-    - uses: actions/setup-node@v4
+    # v5.0.0
+    - uses: actions/setup-node@13427813f706a0f6c9b74603b31103c40ab1c35a
       with:
         node-version-file: '.nvmrc'
         cache: npm

.github/workflows/lint.yml

@@ -8,7 +8,8 @@ jobs:
     lint:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
+            # v5.0.0
+            - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
 
             - name: Setup Node
               # v4

.github/workflows/reassurePerfTests.yml

@@ -50,8 +50,9 @@ jobs:
       - name: Run Reassure delta tests
         run: npx reassure --branch --verbose
 
+      # v4.6.2
       - name: Upload Reassure results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@2848b2cda0e5190984587ec6bb1f36730ca78d50
         with:
           name: results
           path: .reassure/

.github/workflows/test.yml

@@ -8,9 +8,11 @@ jobs:
     test:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
+            # v5.0.0
+            - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
 
-            - uses: actions/cache@v3
+            # 4.3.0
+            - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
               with:
                   path: ~/.npm
                   key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}

.github/workflows/typecheck.yml

@@ -8,7 +8,8 @@ jobs:
     lint:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
+            # v5.0.0
+            - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
 
             - name: Setup Node
               # v4