Pin GHA action versions for Scorecard

Signed-off-by: Margaret Lawson <mlawsonca@google.com>

Author: mlawsonca

.github/workflows/gcp-weekly.yml

@@ -116,7 +116,7 @@ jobs:
             echo "FVERSION=$FVERSION" >> $GITHUB_ENV
             echo "COMMIT_STATUS_DISTRO_VERSION=$COMMIT_STATUS_DISTRO_VERSION" >> $GITHUB_ENV
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1
         with:
           # DO NOT LAND THIS. This is for testing only
           ref: ${{ github.event.pull_request.head.sha }}
@@ -162,7 +162,7 @@ jobs:
              cat mock_result/build.log
       - name: Save RPM build logs
         continue-on-error: true
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808  # v4.3.3
         with:
           name: ${{ env.STAGE_NAME }} logs
           path: |
@@ -186,12 +186,12 @@ jobs:
         run: rm -f ${REPO_PATH}lastSuccessfulBuild;
              exit 1
       - name: Publish RPMs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808  # v4.3.3
         with:
           name: ${{ env.DISTRO_NAME }} ${{ env.DISTRO_VERSION }} RPM repository
           path: ${{ env.REPO_PATH}}${{ github.run_number }}/artifact/artifacts/${{ env.TARGET }}
       - name: Update commit status
-        uses: ouzi-dev/commit-status-updater@v2
+        uses: ouzi-dev/commit-status-updater@26588d166ff273fc4c0664517359948f7cdc9bf1  # v2.0.2
         with:
           # yamllint disable-line rule:line-length
           name: 'build/Build RPM on ${{ env.DISTRO_NAME }} ${{ env.COMMIT_STATUS_DISTRO_VERSION && env.COMMIT_STATUS_DISTRO_VERSION || env.DISTRO_VERSION }}'
@@ -300,7 +300,7 @@ jobs:
             echo "LABEL=$LABEL" >> $GITHUB_ENV
             echo "INST_RPMS=$INST_RPMS" >> $GITHUB_ENV
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1
         with:
           submodules: true
           fetch-depth: 500
@@ -353,14 +353,14 @@ jobs:
       - name: Publish artifacts
         if: (!cancelled()) && (success() || failure()) &&
             steps.run-test.outcome != 'skipped'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808  # v4.3.3
         with:
           name: ${{ env.STAGE_NAME }} artifacts
           path: ${{ env.STAGE_NAME }}/**
       - name: Upload test results
         if: (success() || failure()) &&
             steps.run-test.outcome != 'skipped'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808  # v4.3.3
         with:
           name: ${{ env.STAGE_NAME }} test-results
           path: ${{ env.STAGE_NAME }}/**/results.xml
@@ -462,7 +462,7 @@ jobs:
             echo "INST_RPMS=$INST_RPMS" >> $GITHUB_ENV
             echo "SIZE=$SIZE" >> $GITHUB_ENV
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1
         with:
           submodules: true
           fetch-depth: 500
@@ -507,22 +507,22 @@ jobs:
       - name: Publish test results
         if: (!cancelled()) && (success() || failure()) &&
             steps.run-test.outcome != 'skipped'
-        uses: EnricoMi/publish-unit-test-result-action@v2
+        uses: EnricoMi/publish-unit-test-result-action@170bf24d20d201b842d7a52403b73ed297e6645b  # v2.18.0
         with:
           check_name: ${{ env.STAGE_NAME }} Test Results (old)
           github_token: ${{ secrets.GITHUB_TOKEN }}
           junit_files: ${{ env.STAGE_NAME }}/**/results.xml
       - name: Publish artifacts
         if: (!cancelled()) && (success() || failure()) &&
             steps.run-test.outcome != 'skipped'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808  # v4.3.3
         with:
           name: ${{ env.STAGE_NAME }} artifacts
           path: ${{ env.STAGE_NAME }}/**
       - name: Upload test results
         if: (success() || failure()) &&
             steps.run-test.outcome != 'skipped'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808  # v4.3.3
         with:
           name: ${{ env.STAGE_NAME }} test-results
           path: ${{ env.STAGE_NAME }}/**/results.xml