chore(deps): Pin dependencies

Author: renovate[bot]

.github/workflows/ci-cd.yml

@@ -106,11 +106,11 @@ jobs:
 
     steps:
     - name: Switch to using Python 3.13 by default
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
       with:
         python-version: 3.13
     - name: Check out src from Git
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         fetch-depth: 0
     - name: >-
@@ -162,7 +162,7 @@ jobs:
         echo "dir=$(python -m pip cache dir)" >> "${GITHUB_OUTPUT}"
       shell: bash
     - name: Set up pip cache
-      uses: actions/cache@v4
+      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
       with:
         path: ${{ steps.pip-cache-dir.outputs.dir }}
         key: >-
@@ -268,12 +268,12 @@ jobs:
 
     steps:
     - name: Switch to using Python 3.13
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
       with:
         python-version: 3.13
 
     - name: Grab the source from Git
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         fetch-depth: 0
 
@@ -301,7 +301,7 @@ jobs:
       run: >-
         echo "dir=$(python -m pip cache dir)" >> "${GITHUB_OUTPUT}"
     - name: Set up pip cache
-      uses: actions/cache@v4
+      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
       with:
         path: ${{ steps.pip-cache-dir.outputs.dir }}
         key: >-
@@ -359,7 +359,7 @@ jobs:
         >> "${GITHUB_OUTPUT}"
       working-directory: dist
     - name: Store the distribution packages
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
       with:
         name: >-
           ${{ needs.pre-setup.outputs.dists-artifact-name }}

.github/workflows/reusable-tox.yml

@@ -155,7 +155,7 @@ jobs:
         Switch to using Python v${{ inputs.python-version }}
         by default
       id: python-install
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
       with:
         python-version: ${{ inputs.python-version }}
 
@@ -165,7 +165,7 @@ jobs:
     - name: Grab the source from Git
       if: >-
         contains(fromJSON('["pre-commit", "spellcheck-docs"]'), inputs.toxenv)
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         ref: ${{ github.event.inputs.release-committish }}
     - name: Retrieve the project source from an sdist inside the GHA artifact
@@ -178,7 +178,7 @@ jobs:
 
     - name: Cache pre-commit.com virtualenvs
       if: inputs.toxenv == 'pre-commit'
-      uses: actions/cache@v4
+      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
       with:
         path: ~/.cache/pre-commit
         key: >-
@@ -236,7 +236,7 @@ jobs:
       shell: bash
     - name: Set up pip cache
       if: fromJSON(steps.py-abi.outputs.is-stable-abi)
-      uses: actions/cache@v4
+      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
       with:
         path: ${{ steps.pip-cache-dir.outputs.dir }}
         key: >-
@@ -263,7 +263,7 @@ jobs:
     - name: Download all the dists
       if: >-
         contains(fromJSON('["metadata-validation", "pytest"]'), inputs.toxenv)
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
       with:
         name: ${{ inputs.dists-artifact-name }}
         path: dist/
@@ -312,7 +312,7 @@ jobs:
       if: >-
         !cancelled()
         && steps.tox-run.outputs.test-result-files != ''
-      uses: test-summary/[email protected]
+      uses: test-summary/action@032c8a9cec6aaa3c20228112cae6ca10a3b29336 # v2.3
       with:
         paths: >-
           ${{ steps.tox-run.outputs.test-result-files }}
@@ -329,7 +329,7 @@ jobs:
         && steps.tox-run.outputs.cov-report-files != ''
         && steps.tox-run.outputs.test-result-files == ''
         && steps.tox-run.outputs.codecov-flags != 'MyPy'
-      uses: irongut/[email protected]
+      uses: irongut/CodeCoverageSummary@51cc3a756ddcd398d447c044c02cb6aa83fdae95 # v1.3.0
       with:
         badge: true
         filename: >-
@@ -367,7 +367,7 @@ jobs:
       if: >-
         !cancelled()
         && steps.tox-run.outputs.cov-report-files != ''
-      uses: codecov/codecov-action@v4
+      uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
       with:
         disable_search: true
         fail_ci_if_error: >-