chore(deps): pin dependencies (#787)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/workflows/closing.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Add closed question comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
       if: |
         github.actor != 'renovate[bot]' &&
         github.event.issue.state_reason == 'completed' &&
@@ -42,7 +42,7 @@ jobs:
           * In case you see a similar problem, please open a separate issue.
           * If you are happy with the outcome, don’t hesitate to support Weblate by making a [donation](https://weblate.org/donate/).
     - name: Add closed issue comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
       if: |
         github.actor != 'renovate[bot]' &&
         github.event.issue.state_reason == 'completed' &&

.github/workflows/label-sync.yml

@@ -21,7 +21,7 @@ jobs:
     name: Sync labels
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v4
-    - uses: srealmoreno/label-sync-action@v2
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+    - uses: srealmoreno/label-sync-action@850ba5cef2b25e56c6c420c4feed0319294682fd # v2
       with:
         clean-labels: true

.github/workflows/labels.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Add backlog comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
       if: ${{ github.event.label.name == 'backlog' }}
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
@@ -33,7 +33,7 @@ jobs:
           In case you need this feature soon, please consider helping
           or push it by [funding the development](https://weblate.org/support/).
     - name: Add undecided comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
       if: ${{ github.event.label.name == 'undecided' }}
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
@@ -46,7 +46,7 @@ jobs:
 
           Please try to clarify the use case or consider proposing something more generic to make it useful to more users.
     - name: Add question comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
       if: ${{ github.event.label.name == 'question' }}
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
@@ -63,7 +63,7 @@ jobs:
 
           In case your question is already answered, [making a donation](https://weblate.org/donate/) is the right way to say thank you!
     - name: Add translate-toolkit comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
       if: ${{ github.event.label.name == 'translate-toolkit' }}
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
@@ -72,7 +72,7 @@ jobs:
           The issue you've reported needs to be addressed in the [translate-toolkit](https://github.com/translate/translate/).
           Please file the issue there, and include links to any relevant specifications about the formats (if applicable).
     - name: Add good first issue comment
-      uses: peter-evans/create-or-update-comment@v4
+      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
       if: ${{ github.event.label.name == 'good first issue' }}
       with:
         token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pre-commit.yml

@@ -20,16 +20,16 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/cache@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+    - uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4
       with:
         path: ~/.cache/pre-commit
         key: ${{ runner.os }}-pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
     - name: Setup Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
       with:
         python-version: '3.13'
-    - uses: astral-sh/setup-uv@v5
+    - uses: astral-sh/setup-uv@4db96194c378173c656ce18a155ffc14a9fc4355 # v5
     - name: detect method
       id: detect
       run: |

.github/workflows/pull_requests.yaml

@@ -22,7 +22,7 @@ jobs:
     name: Weblate automerge
     if: github.actor == 'weblate'
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
     - name: Enable Pull Request Automerge
       run: gh pr merge --rebase --auto "${{ github.event.pull_request.number }}"
       env:

.github/workflows/stale.yml

@@ -26,7 +26,7 @@ jobs:
       pull-requests: write
 
     steps:
-    - uses: actions/stale@v9
+    - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
       with:
         days-before-pr-stale: 30
         days-before-pr-close: 14

.github/workflows/uv-upgrade.yml

@@ -28,15 +28,15 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       if: github.event_name != 'pull_request'
       with:
         token: ${{ secrets.WEBLATE_CI_TOKEN }}
 
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       if: github.event_name == 'pull_request'
 
-    - uses: astral-sh/setup-uv@v5
+    - uses: astral-sh/setup-uv@4db96194c378173c656ce18a155ffc14a9fc4355 # v5
       with:
         enable-cache: true
         cache-dependency-glob: ''
@@ -49,7 +49,7 @@ jobs:
         fi
 
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
       with:
         python-version: '3.13'
 
@@ -62,14 +62,14 @@ jobs:
 
     - name: Update current branch
       if: ( github.event_name == 'pull_request' && github.actor != 'renovate[bot]' ) || ( github.event_name == 'push' && github.ref_name != 'main' )
-      uses: stefanzweifel/git-auto-commit-action@v5
+      uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # v5
       with:
         commit_message: 'chore(deps): update lockfile'
 
     - name: Create Pull Request
       id: cpr
       if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-      uses: peter-evans/create-pull-request@v7
+      uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7
       with:
         branch: create-pull-request/yarn-update
         title: 'chore(deps): update lockfile'

.github/workflows/yarn-update.yml

@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         token: ${{ secrets.WEBLATE_CI_TOKEN }}
 
@@ -57,14 +57,14 @@ jobs:
 
     - name: Update current branch
       if: github.ref != 'refs/heads/main'
-      uses: stefanzweifel/git-auto-commit-action@v5
+      uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # v5
       with:
         commit_message: 'chore(js): update vendored libraries'
 
     - name: Create Pull Request
       id: cpr
       if: github.ref == 'refs/heads/main'
-      uses: peter-evans/create-pull-request@v7
+      uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7
       with:
         branch: create-pull-request/yarn-update
         title: 'chore(js): update vendored libraries'