fix(deps): pin dependencies (#62)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/actions/install-dependencies/action.yml

@@ -25,7 +25,7 @@ runs:
         fi
     # When the main workflow calls many workspace workflows, we can reuse this cache for all of them.
     # Since this is caching the node_modules directory, DO NOT add partial-match restore keys!
-    - uses: actions/cache/restore@v4
+    - uses: actions/cache/restore@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4
       id: restore-node-modules-cache
       with:
         path: |
@@ -39,7 +39,7 @@ runs:
       working-directory: .
       shell: bash
       run: NODE_ENV=development npm ci
-    - uses: actions/cache/save@v4
+    - uses: actions/cache/save@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4
       if: steps.restore-node-modules-cache.outputs.cache-hit != 'true'
       with:
         path: |

.github/actions/test-package/action.yml

@@ -22,7 +22,7 @@ runs:
         npm run test | tee -a ./test-results/${{ inputs.package_name }}-test-results.txt
     - name: Store Test Results
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
       with:
         name: ${{ inputs.package_name }}-test-output
         path: ./packages/${{ inputs.package_name }}/test-results/*

.github/workflows/ci.yml

@@ -15,12 +15,12 @@ jobs:
     name: Detect affected packages, build and test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4
         with:
           cache: 'npm'
           node-version-file: '.nvmrc'
-      - uses: wagoid/commitlint-github-action@v5
+      - uses: wagoid/commitlint-github-action@9763196e10f27aef304c9b8b660d31d97fce0f99 # v5
       - name: Debug info
         run: |
           cat <<EOF
@@ -32,7 +32,7 @@ jobs:
           Working directory: $(pwd)
           EOF
 
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
         id: filter
         with:
           # Files in the `global` filter affect all workspaces, even if workspace-specific files have not changed.

.github/workflows/publish.yml

@@ -10,8 +10,8 @@ jobs:
   cd:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4
         with:
           cache: 'npm'
           node-version-file: '.nvmrc'
@@ -80,31 +80,31 @@ jobs:
           git push -f origin "refs/tags/${{github.event.release.tag_name}}"
 
       - name: Deploy scratch-svg-renderer to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./packages/scratch-svg-renderer/playground
           destination_dir: scratch-svg-renderer
           full_commit_message: "Build for ${{ github.sha }} ${{ github.event.head_commit.message }}"
 
       - name: Deploy scratch-render to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./packages/scratch-render/playground
           destination_dir: scratch-render
           full_commit_message: "Build for ${{ github.sha }} ${{ github.event.head_commit.message }}"
 
       - name: Deploy scratch-vm to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./packages/scratch-vm/playground
           destination_dir: scratch-vm
           full_commit_message: "Build for ${{ github.sha }} ${{ github.event.head_commit.message }}"
 
       - name: Deploy scratch-gui to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./packages/scratch-gui/build

.github/workflows/update-i18n.yml

@@ -16,8 +16,8 @@ jobs:
   update-i18n:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4
         with:
           cache: 'npm'
           node-version-file: '.nvmrc'