pin actions

Author: artyom-morozov

.github/workflows/publish.yaml

@@ -89,7 +89,7 @@ jobs:
           verbose: true
 
       - name: Update Release with build artifacts
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
         with:
           tag_name: ${{ github.event.release.tag_name }}
           files: |

.github/workflows/release-please.yaml

@@ -21,7 +21,7 @@ jobs:
     steps:
       - name: Run Release Please
         id: release
-        uses: googleapis/release-please-action@v4
+        uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
         with:
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json