Pin dependencies

.github/workflows/bump-release.yml

@@ -27,12 +27,12 @@ jobs:
           echo "semver: ${{ inputs.semver }}"
         shell: bash
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
         with:
           node-version-file: '.node-version'
 

.github/workflows/deploy.yml

@@ -35,10 +35,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout primary repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Setup Node Environment
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
         with:
           node-version-file: '.node-version'
 
@@ -75,7 +75,7 @@ jobs:
           yarn run build:prod
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
         with:
           name: StaticSite
           path: ./out
@@ -95,20 +95,20 @@ jobs:
 
     steps:
       - name: Azure Login
-        uses: azure/login@v2 # v2.0.0
+        uses: azure/login@a65d910e8af852a8061c627c456678983e180302 # v2
         with:
           client-id: ${{ env.ARM_CLIENT_ID }}
           tenant-id: ${{ env.ARM_TENANT_ID }}
           subscription-id: ${{ env.ARM_SUBSCRIPTION_ID }}
 
       - name: Download Artifact
         id: download_artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
         with:
           name: StaticSite
 
       - name: Empty the Storage
-        uses: azure/CLI@v2
+        uses: azure/CLI@089eac9d8cc39f5d003e94f8b65efc51076c9cbd # v2
         with:
           inlineScript: |
             az storage blob delete-batch \
@@ -117,7 +117,7 @@ jobs:
               --source '$web'
 
       - name: Upload to Storage
-        uses: azure/CLI@v2
+        uses: azure/CLI@089eac9d8cc39f5d003e94f8b65efc51076c9cbd # v2
         with:
           inlineScript: |
             az storage blob upload-batch \
@@ -128,7 +128,7 @@ jobs:
               --overwrite
 
       - name: Purge the CDN
-        uses: azure/CLI@v2
+        uses: azure/CLI@089eac9d8cc39f5d003e94f8b65efc51076c9cbd # v2
         with:
           inlineScript: |
             if [ "${{ inputs.DEPLOY }}" == "ioapp.it" ]; then

.github/workflows/make-release.yml

@@ -16,7 +16,7 @@ jobs:
       contents: write
       packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - id: get_version
         name: Get Version
         run: |
@@ -29,7 +29,7 @@ jobs:
           fi
         shell: bash
       - name: Create Release tag
-        uses: ncipollo/[email protected]
+        uses: ncipollo/release-action@a2e71bdd4e7dab70ca26a852f29600c98b33153e # v1.12.0
         with:
           commit: ${{ github.ref_name }}
           tag: v${{ env.new_version }}