fix: pin everyhting and build wasm first

Author: jdrean

.github/workflows/release.yml

@@ -13,26 +13,15 @@ jobs:
     runs-on: macos-14
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
           go-version-file: go.mod
-
-      - name: Set up xcode
-        uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: latest-stable
-
-      - name: Set up gomobile
-        run: |
-          go install golang.org/x/mobile/cmd/gomobile@latest
-          go install golang.org/x/mobile/cmd/gobind@latest
-          go get -u golang.org/x/mobile/bind
-
+      
       - name: Build WASM
         run: |
           go run ./rootfetch/main.go -o client/trusted_root.json
@@ -50,18 +39,29 @@ jobs:
           cp wasm/tinfoil-verifier-*.wasm public/
           cp wasm/tinfoil-verifier-*.wasm public/tinfoil-verifier.wasm
 
+      - name: Set up xcode
+        uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
+        with:
+          xcode-version: latest-stable
+
+      - name: Set up gomobile
+        run: |
+          go install golang.org/x/mobile/cmd/gomobile@v0.0.0-20251209145715-2553ed8ce294
+          go install golang.org/x/mobile/cmd/gobind@v0.0.0-20251209145715-2553ed8ce294
+          go get -u golang.org/x/mobile/bind@v0.0.0-20251209145715-2553ed8ce294
+
       - name: gomobile bind
         run: |
           gomobile bind -target=ios,iossimulator,macos -o TinfoilVerifier.xcframework $(go list ./... | grep -v -E "/examples/|/rootfetch|/wasm" | xargs)
           zip -ry TinfoilVerifier.xcframework.zip TinfoilVerifier.xcframework
 
       - name: Deploy to GH pages
-        uses: JamesIves/github-pages-deploy-action@v4
+        uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0
         with:
           folder: public
 
       - name: Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b #v2.5.0
         with:
           files: |
             TinfoilVerifier.xcframework.zip