Merge pull request #10 from FlowFuse/chore_pin_actions_to_sha

chore: Pin external actions to commit hash

Author: hardillb

.github/workflows/publish.yaml

@@ -10,7 +10,7 @@ on:
 
 jobs:
   build:
-      uses: 'flowfuse/github-actions-workflows/.github/workflows/build_node_package.yml@v0.37.0'
+      uses: 'flowfuse/github-actions-workflows/.github/workflows/build_node_package.yml@v0.39.0'
       with:
         node: '[
                 {"version": "18", "tests": false, "lint": true},
@@ -21,7 +21,7 @@ jobs:
       ( github.event_name == 'push' && github.ref == 'refs/heads/main' ) ||
       ( github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' )
     needs: build
-    uses: 'flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml@v0.37.0'
+    uses: 'flowfuse/github-actions-workflows/.github/workflows/publish_node_package.yml@v0.39.0'
     with:
       package_name: node-red-dashboard-2-ui-flowviewer
       publish_package: true

.github/workflows/release.yaml

@@ -9,10 +9,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 18
 
@@ -25,6 +25,6 @@ jobs:
           npm run test
 
       - name: Publish package
-        uses: JS-DevTools/npm-publish@v3
+        uses: JS-DevTools/npm-publish@19c28f1ef146469e409470805ea4279d47c3d35c # v3.1.1
         with:
           token: ${{ secrets.NPM_PUBLISH_TOKEN }}