Pin workflows to their shas

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
     name: Compile Check
     runs-on: mempool-ci
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Setup Rust
         uses: './.github/actions/ci-rust-setup'
         with:
@@ -23,7 +23,7 @@ jobs:
     name: Formatter
     runs-on: mempool-ci
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Setup Rust
         uses: './.github/actions/ci-rust-setup'
         with:
@@ -34,7 +34,7 @@ jobs:
     name: Run Tests
     runs-on: mempool-ci
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Setup Rust
         uses: './.github/actions/ci-rust-setup'
         with:
@@ -47,17 +47,17 @@ jobs:
     env:
       FREEBSD_VER: "14.3"
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Cache dependencies for FreeBSD
-      uses: actions/cache@v3
+      uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
       with:
         path: |
           .cargohome/registry
           .cargohome/git
           target
         key: freebsd-${{ env.FREEBSD_VER }}-cargo-checks-${{ hashFiles('**/Cargo.lock') }}
     - name: Compile Checks in FreeBSD
-      uses: vmactions/freebsd-vm@v1
+      uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1
       with:
         usesh: true
         release: "${{ env.FREEBSD_VER }}"
@@ -97,7 +97,7 @@ jobs:
           '-F electrum-discovery,liquid',
         ]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Setup Rust
         uses: './.github/actions/ci-rust-setup'
         with:

.github/workflows/on-tag.yml

@@ -42,21 +42,21 @@ jobs:
         run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
 
       - name: Checkout project
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
         id: qemu
 
       - name: Setup Docker buildx action
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
         id: buildx
 
       - name: Available platforms
         run: echo ${{ steps.buildx.outputs.platforms }}
 
       - name: Cache Docker layers
-        uses: actions/cache@v3
+        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
         id: cache
         with:
           path: /tmp/.buildx-cache

.github/workflows/project-review-status.yml

@@ -8,11 +8,11 @@
 
 jobs:
   project-automation:
-    uses: mempool/.github/.github/workflows/project-board-automation.yml@master
+    uses: mempool/.github/.github/workflows/project-board-automation.yml@86b3a255a9a60ac3396d516bd26a64a171aef7d5 # master
     with:
       project-number: 8
     secrets:
       PROJECT_TOKEN: ${{ secrets.PROJECT_TOKEN }}
       PROJECT_ID: ${{ secrets.PROJECT_ID }}
       STATUS_FIELD_ID: ${{ secrets.STATUS_FIELD_ID }}
       REVIEW_NEEDED_OPTION_ID: ${{ secrets.REVIEW_NEEDED_OPTION_ID }}