chore(deps): pin dependencies (#1854)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/workflows/build.yml

@@ -36,7 +36,7 @@ jobs:
         run: rm -rfv dist/mac-universal
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4.6.1
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: Gitify-dist-mac
           path: dist/
@@ -68,7 +68,7 @@ jobs:
         run: Remove-Item dist/win-unpacked -Recurse
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4.6.1
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: Gitify-dist-win
           path: dist
@@ -100,7 +100,7 @@ jobs:
         run: rm -rfv dist/linux-unpacked
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4.6.1
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: Gitify-dist-linux
           path: dist

.github/workflows/publish.yml

@@ -42,7 +42,7 @@ jobs:
           NOTARIZE: true
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4.6.1
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: Gitify-release-mac
           path: dist/
@@ -76,7 +76,7 @@ jobs:
           GH_TOKEN: ${{ secrets.github_token }}
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4.6.1
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: Gitify-release-win
           path: dist/
@@ -110,7 +110,7 @@ jobs:
           GH_TOKEN: ${{ secrets.github_token }}
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4.6.1
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: Gitify-release-linux
           path: dist/

.github/workflows/test.yml

@@ -29,7 +29,7 @@ jobs:
       - run: pnpm test --coverage --runInBand --verbose
 
       - name: Archive code coverage results
-        uses: actions/upload-artifact@v4.6.1
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: code-coverage-report
           path: coverage/lcov.info
@@ -59,13 +59,13 @@ jobs:
       - run: pnpm install
 
       - name: Download a single artifact
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: code-coverage-report
           path: coverage/
 
       - name: SonarQube Cloud Scan
-        uses: SonarSource/sonarqube-scan-action@v5.0.0
+        uses: SonarSource/sonarqube-scan-action@0303d6b62e310685c0e34d0b9cde218036885c4d # v5.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/triage.yml

@@ -21,7 +21,7 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v7.0.1
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             const title = context.payload.pull_request.title;
@@ -45,4 +45,4 @@ jobs:
     name: Auto-label PR
     runs-on: ubuntu-latest
     steps:
-      - uses: fuxingloh/multi-labeler@v4.0.0
+      - uses: fuxingloh/multi-labeler@b15a54460c38f54043fa75f7b08a0e2aa5b94b5b # v4.0.0