chore(ci): pin 3rd party github actions

.github/workflows/dependabot-merge.yml

@@ -14,7 +14,7 @@ jobs:
       # will not occur.
       - name: Dependabot metadata
         id: dependabot-metadata
-        uses: dependabot/fetch-metadata@v3.1.0
+        uses: dependabot/fetch-metadata@7a4b92f93a688100997537756415299e15fc2431
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
       # Here the PR gets approved.
@@ -27,7 +27,7 @@ jobs:
       # Finally, tell dependabot to merge the PR if all checks are successful
       - name: Instruct dependabot to squash & merge
         if: ${{ steps.dependabot-metadata.outputs.update-type != 'version-update:semver-major' }}
-        uses: mshick/add-pr-comment@v3
+        uses: mshick/add-pr-comment@ec328af66588ab8f77cdeb2c264f14aba45bbf59
         with:
           repo-token: ${{ secrets.SWAGGER_BOT_GITHUB_TOKEN }}
           allow-repeats: true

.github/workflows/docker-build-push.yml

@@ -60,19 +60,19 @@ jobs:
           echo "RELEASED_VERSION=$RELEASED_VERSION" >> $GITHUB_ENV
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@288220e341e5c445ddb6d73e19a57a9012ceca88
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@5b9cf3909b54a280b6df6eee035755eb1f2fd611
 
       - name: Log in to DockerHub
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
         with:
           username: ${{ secrets.DOCKERHUB_SB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_SB_PASSWORD }}
 
       - name: Build docker image and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@b9769986761dfcf8828a58eadbd440d1738476f9
         with:
           context: .
           push: true
@@ -81,7 +81,7 @@ jobs:
           tags: swaggerapi/swagger-editor:latest,swaggerapi/swagger-editor:v${{ env.RELEASED_VERSION }}
 
       - name: Build unprivileged docker image and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@b9769986761dfcf8828a58eadbd440d1738476f9
         with:
           context: .
           file: Dockerfile.unprivileged

.github/workflows/release.yml

@@ -23,7 +23,7 @@ jobs:
           node-version-file: .nvmrc
 
       - name: Determine the next release version
-        uses: cycjimmy/semantic-release-action@v6
+        uses: cycjimmy/semantic-release-action@71b2ac36ece276d61489147b9d5de3cf0d13fad8
         with:
           semantic_version: v24.2.3
           dry_run: true
@@ -58,7 +58,7 @@ jobs:
 
       - name: Semantic Release
         id: semantic
-        uses: cycjimmy/semantic-release-action@v6
+        uses: cycjimmy/semantic-release-action@71b2ac36ece276d61489147b9d5de3cf0d13fad8
         with:
           dry_run: false
           extra_plugins: |