chore(deps): Pin dependencies

Author: renovate[bot]

.github/workflows/ci-cd.yml

@@ -111,7 +111,7 @@ jobs:
       with:
         python-version: 3.13
     - name: Check out src from Git
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         fetch-depth: 0
     - name: >-
@@ -163,7 +163,7 @@ jobs:
         echo "dir=$(python -m pip cache dir)" >> "${GITHUB_OUTPUT}"
       shell: bash
     - name: Set up pip cache
-      uses: actions/cache@v4
+      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
       with:
         path: ${{ steps.pip-cache-dir.outputs.dir }}
         key: >-
@@ -275,7 +275,7 @@ jobs:
         python-version: 3.13
 
     - name: Grab the source from Git
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         fetch-depth: 0
 
@@ -303,7 +303,7 @@ jobs:
       run: >-
         echo "dir=$(python -m pip cache dir)" >> "${GITHUB_OUTPUT}"
     - name: Set up pip cache
-      uses: actions/cache@v4
+      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
       with:
         path: ${{ steps.pip-cache-dir.outputs.dir }}
         key: >-

.github/workflows/reusable-tox.yml

@@ -166,7 +166,7 @@ jobs:
     - name: Grab the source from Git
       if: >-
         contains(fromJSON('["pre-commit", "spellcheck-docs"]'), inputs.toxenv)
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         ref: ${{ github.event.inputs.release-committish }}
     - name: Retrieve the project source from an sdist inside the GHA artifact
@@ -179,7 +179,7 @@ jobs:
 
     - name: Cache pre-commit.com virtualenvs
       if: inputs.toxenv == 'pre-commit'
-      uses: actions/cache@v4
+      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
       with:
         path: ~/.cache/pre-commit
         key: >-
@@ -237,7 +237,7 @@ jobs:
       shell: bash
     - name: Set up pip cache
       if: fromJSON(steps.py-abi.outputs.is-stable-abi)
-      uses: actions/cache@v4
+      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
       with:
         path: ${{ steps.pip-cache-dir.outputs.dir }}
         key: >-
@@ -264,7 +264,7 @@ jobs:
     - name: Download all the dists
       if: >-
         contains(fromJSON('["metadata-validation", "pytest"]'), inputs.toxenv)
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
       with:
         name: ${{ inputs.dists-artifact-name }}
         path: dist/
@@ -313,7 +313,7 @@ jobs:
       if: >-
         !cancelled()
         && steps.tox-run.outputs.test-result-files != ''
-      uses: test-summary/action@v2.3
+      uses: test-summary/action@032c8a9cec6aaa3c20228112cae6ca10a3b29336 # v2.3
       with:
         paths: >-
           ${{ steps.tox-run.outputs.test-result-files }}
@@ -330,7 +330,7 @@ jobs:
         && steps.tox-run.outputs.cov-report-files != ''
         && steps.tox-run.outputs.test-result-files == ''
         && steps.tox-run.outputs.codecov-flags != 'MyPy'
-      uses: irongut/CodeCoverageSummary@v1.3.0
+      uses: irongut/CodeCoverageSummary@51cc3a756ddcd398d447c044c02cb6aa83fdae95 # v1.3.0
       with:
         badge: true
         filename: >-