Upgrade and pin GitHub Actions

.github/workflows/clear_cache.yml

@@ -11,7 +11,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        # https://github.com/actions/checkout/releases/tag/v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Cleanup
         run: |
@@ -34,4 +35,4 @@ jobs:
           done
           echo "Done"
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/python-lint.yml

@@ -10,8 +10,10 @@ jobs:
   ruff-format:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/ruff-action@v3
+      # https://github.com/actions/checkout/releases/tag/v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      # https://github.com/astral-sh/ruff-action/releases/tag/v4.1.0
+      - uses: astral-sh/ruff-action@278981a28ce3188b1e39527901f38254bf3aac89
         with:
           args: "--version"
       - run: ruff check

.github/workflows/search-tests.yml

@@ -18,10 +18,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    # https://github.com/actions/checkout/releases/tag/v7.0.1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      # https://github.com/docker/setup-buildx-action/releases/tag/v4.2.0
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c
 
     - name: Setup
       run: bash -c 'mkdir -p ./freesound-data/{packs,uploads,avatars} && echo FS_USER_ID_FROM_ENV=$(id -u) > .env && cp freesound/local_settings.example.py freesound/local_settings.py'
@@ -37,7 +39,8 @@ jobs:
       run: docker compose -f docker-compose.test.yml pull db search
 
     - name: Build test_runner image
-      uses: docker/build-push-action@v5
+      # https://github.com/docker/build-push-action/releases/tag/v7.3.0
+      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
       with:
         context: .
         file: ./docker/Dockerfile.workers_web

.github/workflows/unit-tests.yml

@@ -12,10 +12,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    # https://github.com/actions/checkout/releases/tag/v7.0.1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      # https://github.com/docker/setup-buildx-action/releases/tag/v4.2.0
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c
 
     - name: Setup
       run: bash -c 'mkdir -p ./freesound-data/{packs,uploads,avatars} && echo FS_USER_ID_FROM_ENV=$(id -u) > .env && cp freesound/local_settings.example.py freesound/local_settings.py'
@@ -31,7 +33,8 @@ jobs:
       run: docker compose -f docker-compose.test.yml pull db redis
 
     - name: Build test_runner image
-      uses: docker/build-push-action@v5
+      # https://github.com/docker/build-push-action/releases/tag/v7.3.0
+      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
       with:
         context: .
         file: ./docker/Dockerfile.workers_web