Merge pull request #1386 from square/renovate/pin-dependencies

Pin dependencies

Author: steve-the-edwards

.github/actions/gradle-task-with-commit/action.yml

@@ -75,7 +75,7 @@ runs:
 
     - name: commit ${{ inputs.fix-task }} changes
       if: steps.can-push.outputs.can_push == 'true'
-      uses: stefanzweifel/git-auto-commit-action@v6
+      uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6
       with:
         commit_message: ${{ steps.set-commit-message.outputs.commit-message }}
         commit_options: '--no-verify --signoff'

.github/workflows/kotlin.yml

@@ -50,7 +50,7 @@ jobs:
       # We use the workflow-pr-fixer app to authenticate and get a token that will cause the workflow
       # to be triggered again.
       - name: Generate App Token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
         id: app-token
         with:
           app-id: ${{ vars.APP_ID }}
@@ -74,7 +74,7 @@ jobs:
       # We use the workflow-pr-fixer app to authenticate and get a token that will cause the workflow
       # to be triggered again.
       - name: Generate App Token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
         id: app-token
         with:
           app-id: ${{ vars.APP_ID }}
@@ -97,7 +97,7 @@ jobs:
       # We use the workflow-pr-fixer app to authenticate and get a token that will cause the workflow
       # to be triggered again.
       - name: Generate App Token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
         id: app-token
         with:
           app-id: ${{ vars.APP_ID }}
@@ -122,7 +122,7 @@ jobs:
       # We use the workflow-pr-fixer app to authenticate and get a token that will cause the workflow
       # to be triggered again.
       - name: Generate App Token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
         id: app-token
         with:
           app-id: ${{ vars.APP_ID }}
@@ -147,7 +147,7 @@ jobs:
       # We use the workflow-pr-fixer app to authenticate and get a token that will cause the workflow
       # to be triggered again.
       - name: Generate App Token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
         id: app-token
         with:
           app-id: ${{ vars.APP_ID }}

.github/workflows/validate-documentation.yml

@@ -16,7 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Set up Ruby 2.6
-        uses: ruby/setup-ruby@v1.229.0
+        uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1.229.0
         with:
           ruby-version: 3.4.2
       - name: Install dependencies