ci: pin action tags to commit SHAs in cli-validate

Signed-off-by: Dorin Geman <dorin.geman@docker.com>

Author: doringeman

.github/workflows/cli-validate.yml

@@ -54,12 +54,12 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
         with:
           buildkitd-flags: --debug
       -
         name: Validate
-        uses: docker/bake-action@v7
+        uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7
         with:
           files: ./cmd/cli/docker-bake.hcl
           targets: ${{ matrix.target }}