chore(deps): pin dependencies

Author: radagastbot[bot]

.github/workflows/cd.yaml

@@ -24,12 +24,12 @@ jobs:
           egress-policy: audit
 
       - name: 📦 Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
 
       - name: 🇳 Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22.18.0"
 
@@ -62,17 +62,17 @@ jobs:
 
     steps:
       - name: 📦 Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
 
       - name: 🇳 Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22.18.0"
 
       - name: ⬇️ Download build artifact
-        uses: dawidd6/action-download-artifact@v11
+        uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
         with:
           workflow: ci.yaml
           name: blog-${{ github.event.workflow_run.head_sha }}
@@ -93,7 +93,7 @@ jobs:
           git push origin "v${{ env.RELEASE_VERSION }}"
 
       - name: 📝 Generate changelog
-        uses: orhun/git-cliff-action@v4
+        uses: orhun/git-cliff-action@98c93442bb05a455a77bee982867857ae748eeea # v4
         with:
           config: cliff.toml
           args: -vv --latest --strip header
@@ -102,7 +102,7 @@ jobs:
           GITHUB_REPO: ${{ github.repository }}
 
       - name: 🚀 Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2
         with:
           files: |
             blog-${{ env.RELEASE_VERSION }}.tar.gz

.github/workflows/ci.yaml

@@ -46,7 +46,7 @@ jobs:
           restore-keys: |
 
       - name: ⚒️ Setup just
-        uses: extractions/setup-just@v3
+        uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
         with:
           just-version: "1.40.0"
 
@@ -91,7 +91,7 @@ jobs:
           restore-keys: |
 
       - name: ⚒️ Setup just
-        uses: extractions/setup-just@v3
+        uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
         with:
           just-version: "1.40.0"
 
@@ -142,7 +142,7 @@ jobs:
           restore-keys: |
 
       - name: ⚒️ Setup just
-        uses: extractions/setup-just@v3
+        uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
         with:
           just-version: "1.40.0"
 
@@ -194,13 +194,13 @@ jobs:
           fetch-depth: 0
 
       - name: ⬇️ Download test coverage report
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
         with:
           name: test-coverage
           path: coverage/
 
       - name: ⬇️ Download test-ui coverage report
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
         with:
           name: test-ui-coverage
           path: ui-tests-report/
@@ -254,7 +254,7 @@ jobs:
           restore-keys: |
 
       - name: ⚒️ Setup just
-        uses: extractions/setup-just@v3
+        uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
         with:
           just-version: "1.40.0"
 

.github/workflows/docker.yaml

@@ -41,7 +41,7 @@ jobs:
           fetch-depth: 0
 
       - name: 🔑 Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -63,7 +63,7 @@ jobs:
 
       - name: 🐳 Build Docker metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |

.github/workflows/spellcheck.yaml

@@ -42,9 +42,9 @@ jobs:
           fetch-depth: 0
 
       - name: ⚒️ Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
-          python-version: 3.13
+          python-version: 3.13.7
 
       - name: ⚙️ Install dependencies
         run: |