.github: update and pin actions

Updates #cleanup

Signed-off-by: Erisa A <[email protected]>

Author: Erisa

.github/workflows/package.yml

@@ -11,7 +11,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
       - name: Fetch tags
@@ -20,15 +20,15 @@ jobs:
         id: yarn-cache-folder
         run: echo "YARN_CACHE_FOLDER=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
       - name: Yarn cache
-        uses: actions/cache@v3
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
         id: yarn-cache
         with:
           path: ${{ steps.yarn-cache-folder.outputs.YARN_CACHE_FOLDER }}
           key: yarn-cache
       - name: Install dependencies
         run: tool/yarn install --frozen-lockfile
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
         with:
           go-version: '1.21.x'
       - name: Capture version
@@ -39,7 +39,7 @@ jobs:
         env:
           GORELEASER_CURRENT_TAG: ${{ steps.version.outputs.npm_package_version }}
       - name: Upload vsix artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: vsix
           path: '*.vsix'

.github/workflows/release.yml

@@ -48,9 +48,9 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - name: Download vsix artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
         with:
           name: vsix
       - name: 'Release'

.github/workflows/test.yml

@@ -13,12 +13,12 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - name: Capture Yarn cache path
         id: yarn-cache-folder
         run: echo "YARN_CACHE_FOLDER=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
       - name: Yarn cache
-        uses: actions/cache@v3
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
         id: yarn-cache
         if: runner.os != 'Windows'
         with: