Security: Pinning dep versions

Author: lamATnginx

.github/workflows/build-push.yml

@@ -33,10 +33,10 @@ jobs:
       needs: deploy-example-site
       runs-on: ubuntu-22.04
       steps:
-        - uses: actions/checkout@v5
+        - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
           with:
             ref: ${{ github.event.workflow_run.head_branch }}
-        - uses: actions/setup-node@v5
+        - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
           with:
             node-version: 22
         - name: Installing packages
@@ -47,7 +47,7 @@ jobs:
           run: | 
               node performance/lighthouse-script.js
         - name: Download the artifact for main
-          uses: actions/download-artifact@v4
+          uses: actions/download-artifact@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
           with:
             name: lighthouse-reports-main
             path: ./main-report
@@ -84,7 +84,7 @@ jobs:
                     fi
                   fi
               done
-        - uses: actions/upload-artifact@v4
+        - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
           if: ${{ !cancelled() }}
           with:
               name: lighthouse-reports-pr

.github/workflows/lighthouse.yml

@@ -13,10 +13,10 @@ jobs:
   generate-lighthouse-report:
     runs-on: ubuntu-22.04
     steps:
-        - uses: actions/checkout@v5
+        - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
           with:
             ref: ${{ github.event.workflow_run.head_branch }}
-        - uses: actions/setup-node@v5
+        - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
           with:
             node-version: 18
         - name: Installing packages
@@ -36,7 +36,7 @@ jobs:
             GITHUB_PR_NUMBER: ${{ env.GITHUB_PR_NUMBER }}
           run: |
             node performance/lighthouse-script.js
-        - uses: actions/upload-artifact@v4
+        - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
           with:
             name: lighthouse-reports-main
             path: lighthouse-reports/main-report.json

performance/package.json

@@ -3,7 +3,7 @@
   "version": "1.0.0",
   "private": "true",
   "devDependencies": {
-    "lighthouse": "^12.2.2",
-    "puppeteer": "^24.22.0"
+    "lighthouse": "12.2.2",
+    "puppeteer": "24.22.0"
   }
 }