INTPYTHON-608 Use pinned sources for GitHub Actions

Author: blink1073

.github/workflows/benchmark.yml

@@ -31,7 +31,7 @@ jobs:
           cache: 'pip'
           cache-dependency-path: '**/setup.cfg'
       - name: Start MongoDB
-        uses: supercharge/[email protected]
+        uses: supercharge/mongodb-github-action@90004df786821b6308fb02299e5835d0dae05d0d # 1.12.0
         with:
           mongodb-version: 6.0
       - name: Install deps

.github/workflows/dist-python.yml

@@ -65,7 +65,7 @@ jobs:
 
       - name: Set up QEMU
         if: matrix.buildplat[1] == 'manylinux_aarch64'
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
         with:
           # setup-qemu-action by default uses `tonistiigi/binfmt:latest` image,
           # which is out of date. This causes seg faults during build.

.github/workflows/release-python.yml

@@ -88,14 +88,14 @@ jobs:
         name: all-dist-${{ github.run_id }}
         path: dist/
     - name: Publish package distributions to TestPyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1
       with:
         repository-url: https://test.pypi.org/legacy/
         skip-existing: true
         attestations: ${{ env.DRY_RUN }}
     - name: Publish distribution 📦 to PyPI
       if: startsWith(env.DRY_RUN, 'false')
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1
 
   post-publish:
     needs: [publish]

.github/workflows/test-python.yml

@@ -56,7 +56,7 @@ jobs:
            echo "LD_LIBRARY_PATH=$PWD/libbson/lib" >> $GITHUB_ENV
       - name: Start MongoDB on Linux
         if: ${{ startsWith(runner.os, 'Linux') }}
-        uses: supercharge/[email protected]
+        uses: supercharge/mongodb-github-action@90004df786821b6308fb02299e5835d0dae05d0d # 1.12.0
         with:
           mongodb-version: 4.4
           mongodb-replica-set: test-rs

.github/workflows/zizmor.yml

@@ -18,15 +18,15 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Rust
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@9d7e65c320fdb52dcd45ffaa68deb6c02c8754d9 # v1
       - name: Get zizmor
         run: cargo install zizmor
       - name: Run zizmor
         run: zizmor --format sarif . > results.sarif
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@28deaeda66b76a05916b6923827895f2b14ab387 # v3
         with:
           sarif_file: results.sarif
           category: zizmor