chore: pin action

Author: brynary

.github/workflows/metadata.yml

@@ -35,7 +35,7 @@ jobs:
       issues: read
       pull-requests: write
     steps:
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           # Find a string in the PR body which matches one of these patterns:
           # close #123

.github/workflows/prepare_release.yml

@@ -23,7 +23,7 @@ jobs:
   prepare-release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2
         id: app-token
         with:
           app-id: ${{ vars.QLTY_APP_ID }}

.github/workflows/release.yml

@@ -15,7 +15,7 @@ jobs:
       version: ${{ steps.version.outputs.version }}
       tag: v${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2
         id: app-token
         with:
           app-id: ${{ vars.QLTY_APP_ID }}
@@ -47,7 +47,7 @@ jobs:
           tag: v0.25.17
 
       - name: Fetch local artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           run-id: ${{ inputs.workflow_run_id }}
           pattern: artifacts-*
@@ -96,7 +96,7 @@ jobs:
           role-session-name: ${{ vars.QLTY_RELEASE_AWS_ROLE_SESSION_NAME }}
           aws-region: ${{ vars.QLTY_RELEASE_AWS_REGION }}
       - name: Fetch local artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           run-id: ${{ inputs.workflow_run_id }}
           pattern: artifacts-*

.github/workflows/update_linter_versions.yml

@@ -61,7 +61,7 @@ jobs:
             qlty-plugins/plugins/linters/**
 
       - name: Read Issues and Create in GitHub
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |