fix(ci): pin GitHub Actions to commit SHAs (supply chain hardening)

.github/workflows/dependabot-automerge.yml

@@ -22,6 +22,6 @@ jobs:
     if: github.event.workflow_run.conclusion == 'success' && github.actor == 'dependabot[bot]'
 
     steps:
-      - uses: ridedott/merge-me-action@v2
+      - uses: ridedott/merge-me-action@e45e8ab1dd3d3dc1d27b8c0a3f465e40e8c9fb8e # v2
         with:
           GITHUB_TOKEN: ${{ secrets.AWBOT_GH_TOKEN }}

.github/workflows/diagram.yml

@@ -20,7 +20,7 @@ jobs:
           git clone https://github.com/ActivityWatch/docs
           git clone https://github.com/ActivityWatch/activitywatch.github.io
       - name: Update diagram
-        uses: githubocto/repo-visualizer@main
+        uses: githubocto/repo-visualizer@a999615bdab757559bf94bda1fe6eef232765f85 # main
         with:
           commit_message: 'chore: update diagram [skip ci]'
           file_colors: '{"rs": "#b7410e", "py": "#229922", "rst": "pink", "txt": "pink", "md": "pink", "css": "purple", "scss": "purple"}'

.github/workflows/release.yml

@@ -284,7 +284,7 @@ jobs:
 
       - name: Set up Rust
         if: ${{ !matrix.skip_rust }}
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
         id: toolchain
         with:
           toolchain: stable
@@ -479,7 +479,7 @@ jobs:
 
       - name: Set up Rust
         if: ${{ !matrix.skip_rust }}
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
         id: toolchain
         with:
           toolchain: stable
@@ -535,7 +535,7 @@ jobs:
           pip3 install poetry==1.4.2
 
       - name: Build
-        uses: nick-fields/retry@v4
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4
         with:
           timeout_minutes: 60
           max_attempts: 3
@@ -548,7 +548,7 @@ jobs:
             pip freeze
 
       - name: Run tests
-        uses: nick-fields/retry@v4
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4
         with:
           timeout_minutes: 60
           max_attempts: 3
@@ -625,7 +625,7 @@ jobs:
           submodules: 'recursive'
           fetch-depth: 0
 
-      - uses: ActivityWatch/check-version-format-action@v2
+      - uses: ActivityWatch/check-version-format-action@5b223bd718c4c00466359532cf944474f069625a # v2.0.1
         id: version
         with:
           prefix: 'v'
@@ -673,13 +673,13 @@ jobs:
         run: ls -R
         working-directory: dist
 
-      - uses: ActivityWatch/check-version-format-action@v2
+      - uses: ActivityWatch/check-version-format-action@5b223bd718c4c00466359532cf944474f069625a # v2.0.1
         id: version
         with:
           prefix: 'v'
 
       - name: Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
         with:
           draft: true
           files: dist/*/activitywatch-*.*

.github/workflows/winget.yml

@@ -6,7 +6,7 @@ jobs:
   publish:
     runs-on: windows-latest # action can only be run on windows
     steps:
-      - uses: vedantmgoyal2009/winget-releaser@v2
+      - uses: vedantmgoyal2009/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e # v2
         with:
           identifier: ActivityWatch.ActivityWatch
           token: ${{ secrets.GH_TOKEN_WINGET_AUTOUPDATE }}