fix: pin 13 unpinned action(s)

.github/workflows/cifuzz.yml

@@ -18,11 +18,11 @@ jobs:
     steps:
     - name: Build Fuzzers
       id: build
-      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@51fea8a581a325b79f2af174b9f7c04333c283c0 # master
       with:
         oss-fuzz-project-name: 'mosquitto'
     - name: Run Fuzzers
-      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@51fea8a581a325b79f2af174b9f7c04333c283c0 # master
       with:
         oss-fuzz-project-name: 'mosquitto'
         fuzz-seconds: 600

.github/workflows/coverage.yml

@@ -62,7 +62,7 @@ jobs:
     - run: |
         lcov --capture --directory . --output-file coverage.info --no-external
 
-    - uses: codecov/codecov-action@v4
+    - uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         fail_ci_if_error: true

.github/workflows/coverity-scan-develop.yml

@@ -37,7 +37,7 @@ jobs:
             uthash-dev \
             xsltproc
 
-    - uses: vapier/coverity-scan-action@v1
+    - uses: vapier/coverity-scan-action@2068473c7bdf8c2fb984a6a40ae76ee7facd7a85 # v1
       with:
         build_language: 'cxx'
         project: "eclipse/mosquitto"

.github/workflows/coverity-scan-fixes.yml

@@ -34,7 +34,7 @@ jobs:
             uthash-dev \
             xsltproc
 
-    - uses: vapier/coverity-scan-action@v1
+    - uses: vapier/coverity-scan-action@2068473c7bdf8c2fb984a6a40ae76ee7facd7a85 # v1
       with:
         build_language: 'cxx'
         project: "eclipse/mosquitto"

.github/workflows/delete-old-workflow-runs.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Delete workflow runs
-        uses: Mattraks/delete-workflow-runs@v2
+        uses: Mattraks/delete-workflow-runs@b3018382ca039b53d238908238bd35d1fb14f8ee # v2
         with:
           token: ${{ github.token }}
           repository: ${{ github.repository }}

.github/workflows/lock.yml

@@ -16,6 +16,6 @@ jobs:
   action:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v6
+      - uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # v6
         with:
           issue-inactive-days: '90'

.github/workflows/windows-x86.yml

@@ -30,7 +30,7 @@ jobs:
 
 
       - name: vcpkg build
-        uses: johnwason/vcpkg-action@v7
+        uses: johnwason/vcpkg-action@ff71808de10afc0e3160fd079353c69ba0d7dd60 # v7
         id: vcpkg
         with:
           manifest-dir: ${{ github.workspace }}
@@ -42,15 +42,15 @@ jobs:
       - name: Build
         run: cmake --build ${{github.workspace}}/build --config ${{env.BUILD_TYPE}}
 
-      - uses: suisei-cn/actions-download-file@v1.6.1
+      - uses: suisei-cn/actions-download-file@9f75b8c2dad5ccced7509c44a3b881c5613abde2 # v1.6.1
         id: vcredist
         name: Download VC redistributable
         with:
           url: https://aka.ms/vs/17/release/vc_redist.x86.exe
           target: ${{github.workspace}}/installer/
 
       - name: Installer
-        uses: joncloud/makensis-action@v5.0
+        uses: joncloud/makensis-action@971ef20f43e4f9f3af2c7f276cb7348d033da1cd # v5.0
         with:
           script-file: ${{github.workspace}}/installer/mosquitto.nsi
 

.github/workflows/windows.yml

@@ -34,7 +34,7 @@ jobs:
           cmake-version: '3.31.6'
 
       - name: vcpkg build
-        uses: johnwason/vcpkg-action@v7
+        uses: johnwason/vcpkg-action@ff71808de10afc0e3160fd079353c69ba0d7dd60 # v7
         id: vcpkg
         with:
           manifest-dir: ${{ github.workspace }}
@@ -46,15 +46,15 @@ jobs:
       - name: Build
         run: cmake --build ${{github.workspace}}/build64 --config ${{env.BUILD_TYPE}}
 
-      - uses: suisei-cn/actions-download-file@v1.6.1
+      - uses: suisei-cn/actions-download-file@9f75b8c2dad5ccced7509c44a3b881c5613abde2 # v1.6.1
         id: vcredist
         name: Download VC redistributable
         with:
           url: https://aka.ms/vs/17/release/vc_redist.x64.exe
           target: ${{github.workspace}}/installer/
 
       - name: Installer
-        uses: joncloud/makensis-action@v5.0
+        uses: joncloud/makensis-action@971ef20f43e4f9f3af2c7f276cb7348d033da1cd # v5.0
         with:
           script-file: ${{github.workspace}}/installer/mosquitto64.nsi