chore(deps): pin dependencies

Author: renovate[bot]

.github/workflows/trufflehog.yaml

@@ -13,7 +13,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         id: git-intel
         with:
           script: |
@@ -33,7 +33,7 @@ jobs:
             depth = depth + 2
             core.info(`Will fetch ${depth} commits from ${branch}.`)
             return { "depth": depth, "branch": branch }
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{steps.git-intel.outputs.result.branch}}
           fetch-depth: ${{steps.git-intel.outputs.result.depth}}

.github/workflows/understackctl-release.yaml

@@ -38,7 +38,7 @@ jobs:
           make build-all package-all checksums
 
       - name: Upload release artifacts
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2
         with:
           files: |
             go/understackctl/build/*.zip