[CI] Pin all GitHub action uses to commit hash (#16253)

Author: straight-shoota

.github/workflows/docs.yml

@@ -34,7 +34,7 @@ jobs:
         run: echo "$GITHUB_SHA" > ./docs/revision.txt
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v5
+        uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/linux.yml

@@ -110,7 +110,7 @@ jobs:
       uses: actions/checkout@v5
 
     - name: Spell Check Repo
-      uses: crate-ci/[email protected]
+      uses: crate-ci/typos@80c8a4945eec0f6d464eaf9e65ed98ef085283d1 # v1.38.1
       env:
         CLICOLOR: 1
 

.github/workflows/macos.yml

@@ -30,12 +30,12 @@ jobs:
       - name: Download Crystal source
         uses: actions/checkout@v5
 
-      - uses: cachix/install-nix-action@v31
+      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
         with:
           extra_nix_config: |
             experimental-features = nix-command
 
-      - uses: cachix/cachix-action@v16
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
           name: crystal-ci
           signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'

.github/workflows/wasm32.yml

@@ -20,7 +20,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install wasmtime
-        uses: mwilliamson/setup-wasmtime-action@v2
+        uses: mwilliamson/setup-wasmtime-action@bf814d7d8fc3c3a77dfe114bd9fb8a2c575f6ad6 #v2
         with:
           wasmtime-version: "2.0.0"
 

.github/zizmor.yml

@@ -0,0 +1,6 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        actions/*: ref-pin
+        crystal-lang/*: ref-pin