Use SHAs for all GitHub Actions

Author: colinrotherham

.github/workflows/ci.yml

@@ -21,15 +21,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           fetch-depth: 0
 
       - name: Enable corepack
         run: corepack enable
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6.4.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
           cache: yarn
           node-version-file: .nvmrc
@@ -45,7 +45,7 @@ jobs:
 
       - name: Sonar analysis
         if: ${{ env.SONAR_TOKEN }}
-        uses: SonarSource/sonarqube-scan-action@v7
+        uses: SonarSource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995
 
       - name: Package build
         run: yarn build
@@ -59,15 +59,15 @@ jobs:
 
       - name: Switch to PR branch
         if: ${{ github.event_name == 'pull_request' && env.CHROMATIC_PROJECT_TOKEN }}
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           clean: false
           fetch-depth: 0
           ref: ${{ env.CHROMATIC_BRANCH }}
 
       - name: Storybook deploy
         if: ${{ env.CHROMATIC_PROJECT_TOKEN }}
-        uses: chromaui/action@v16.9.1
+        uses: chromaui/action@8d925269a481085d451544f6bd9aa2ab3af55b5d
         with:
           autoAcceptChanges: main
           branchName: ${{ env.CHROMATIC_BRANCH}}

.github/workflows/release.yml

@@ -13,15 +13,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           fetch-depth: 0
 
       - name: Enable corepack
         run: corepack enable
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6.4.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
           cache: yarn
           node-version-file: .nvmrc