pin actions to versions

.github/workflows/ci.yml

@@ -42,7 +42,7 @@ jobs:
               env:
                   GH_TOKEN: ${{ github.token }}
 
-            - uses: gacts/install-dnscontrol@v1
+            - uses: gacts/install-dnscontrol@890ba3249712c51203ccb7aba63307c0091e921b # v1.3.4
               if: github.event_name == 'pull_request' && contains(fromJson(env.CHANGED_FILES), 'dnsconfig.js')
               with:
                   version: 4.14.0

.github/workflows/dnscontrol.yml

@@ -19,7 +19,7 @@ jobs:
         steps:
             - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
-            - uses: gacts/install-dnscontrol@v1
+            - uses: gacts/install-dnscontrol@890ba3249712c51203ccb7aba63307c0091e921b # v1.3.4
               with:
                   version: 4.14.0
 

.github/workflows/publish.yml

@@ -21,7 +21,7 @@ jobs:
         steps:
             - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
-            - uses: gacts/install-dnscontrol@v1
+            - uses: gacts/install-dnscontrol@890ba3249712c51203ccb7aba63307c0091e921b # v1.3.4
               with:
                   version: 4.14.0
 

.github/workflows/raw-api.yml

@@ -34,7 +34,7 @@ jobs:
               run: echo "raw.is-a.dev" > raw-api/CNAME
 
             - name: Commit
-              uses: cpina/github-action-push-to-another-repository@main
+              uses: cpina/github-action-push-to-another-repository@55306faa4ed53b815ae49e564af8cfb359d32ae2 # v1.7.3
               with:
                   source-directory: "raw-api"
                   destination-github-username: is-a-dev