pin commits for everything that uses a secret

Author: Geometer1729

.github/workflows/build-action.yml

@@ -33,7 +33,7 @@ jobs:
         with:
           node-version: '20'
       - name: Wait for bindings-cache
-        uses: fountainhead/action-wait-for-check@v1.2.0
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be
         with:
           checkName: "build-bindings-ubuntu"
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
@@ -341,7 +341,7 @@ jobs:
           git tag $RELEASED_VERSION
           git push origin $RELEASED_VERSION
       - name: Create Release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174
         if: success()
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/doc.yml

@@ -24,7 +24,7 @@ jobs:
           npm ci
           npx typedoc --tsconfig tsconfig.node.json src/index.ts
       - name: Deploy
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./docs

.github/workflows/live-tests.yml

@@ -38,7 +38,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Wait for bindings-cache
-        uses: fountainhead/action-wait-for-check@v1.2.0
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be
         with:
           checkName: "build-bindings-ubuntu"
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
@@ -76,7 +76,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Wait for bindings-cache
-        uses: fountainhead/action-wait-for-check@v1.2.0
+        uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be
         with:
           checkName: "build-bindings-ubuntu"
           ref: ${{ github.event.pull_request.head.sha || github.sha }}

README-dev.md

@@ -15,6 +15,7 @@ Before starting, ensure you have the following tools installed:
 
 - [Git](https://git-scm.com/)
 - [Node.js and npm](https://nodejs.org/)
+- [gh](https://cli.github.com/) (used to download artifacts)
 - [Dune, ocamlc, opam](https://github.com/ocaml/dune) (only needed when compiling o1js from source)
 - [Cargo, rustup](https://www.rust-lang.org/learn/get-started) (only needed when compiling o1js from source)