use commit hashes instead

Author: ffflorian

.github/workflows/actions.lock.json

@@ -16,15 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Verify actions lockfile
-        uses: gjtorikian/[email protected]
-        with:
-          mode: verify
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
         with:
           node-version: 24.x
           cache: yarn

.github/workflows/build_test_publish.yml

@@ -10,16 +10,11 @@ jobs:
   mirror:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
         with:
           fetch-depth: 0
 
-      - name: Verify actions lockfile
-        uses: gjtorikian/[email protected]
-        with:
-          mode: verify
-
-      - uses: yesolutions/[email protected]
+      - uses: yesolutions/mirror-action@662fce0eced8996f64d7fa264d76cddd84827f33
         with:
           REMOTE: 'ssh://[email protected]/ffflorian/node-packages.git'
           GIT_SSH_PRIVATE_KEY: ${{ secrets.CODEBERG_SECRET }}

.github/workflows/codeberg_mirror.yml

@@ -57,12 +57,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Verify actions lockfile
-        uses: gjtorikian/[email protected]
-        with:
-          mode: verify
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
 
       # Add any setup steps before running the `github/codeql-action/init` action.
       # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -72,7 +67,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -101,6 +96,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7
         with:
           category: '/language:${{matrix.language}}'

.github/workflows/codeql.yml

@@ -10,15 +10,10 @@ jobs:
   mirror:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
         with:
           fetch-depth: 0
 
-      - name: Verify actions lockfile
-        uses: gjtorikian/[email protected]
-        with:
-          mode: verify
-
       - name: Mirror + trigger CI
         uses: SvanBoxel/gitlab-mirror-and-ci-action@5c211f993d35256d96b772d995972f434b94e11a
         with: