chore(deps): pin dependencies

.github/actions/setup-job/action.yml

@@ -143,7 +143,7 @@ runs:
     # node
 
     - name: Setup Node.js
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3
       with:
         node-version: ${{ inputs.node_version }}
 
@@ -204,7 +204,7 @@ runs:
     # Restore Cache
 
     - name: Restore PNPM cache
-      uses: actions/cache/restore@v3
+      uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
       if: inputs.skip_node_cache == 'false'
       id: pnpm-cache
       with:
@@ -218,7 +218,7 @@ runs:
           pnpm--${{ steps.restore_cache_key.outputs.key }}
 
     - name: Restore Cypress Cache
-      uses: actions/cache@v3
+      uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
       id: cypress-cache
       if: inputs.browsers == 'true' && inputs.skip_node_cache == 'false'
       with:
@@ -247,7 +247,7 @@ runs:
     # Save Cache
 
     - name: Save Cypress cache
-      uses: actions/cache/save@v3
+      uses: actions/cache/save@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
       if: inputs.save_cache == 'true' && steps.pnpm-cache.outputs.cache-hit != 'true' && inputs.skip_node_cache == 'false'
       with:
         path: |
@@ -256,7 +256,7 @@ runs:
           browsers--${{ steps.cache_key.outputs.key }}
 
     - name: Save PNPM cache
-      uses: actions/cache/save@v3
+      uses: actions/cache/save@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
       if: inputs.save_cache == 'true' && steps.pnpm-cache.outputs.cache-hit != 'true' && inputs.skip_node_cache == 'false'
       with:
         path: |

.github/workflows/__build.yml

@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3
         with:
           fetch-depth: 0
 
@@ -93,7 +93,7 @@ jobs:
           mv nx-mesh.tar.gz ../../
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3
         if: inputs.node_version == 'lts/*'
         with:
           name: nx-mesh

.github/workflows/__code-analysis--codeql.yml

@@ -30,16 +30,16 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@d186a2a36cc67bfa1b860e6170d37fb9634742c7 # v2
         with:
           languages: javascript
 
       # Autobuild attempts to build any compiled languages
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v2
+        uses: github/codeql-action/autobuild@d186a2a36cc67bfa1b860e6170d37fb9634742c7 # v2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@d186a2a36cc67bfa1b860e6170d37fb9634742c7 # v2
 
       - name: Setup Job
         id: setup
@@ -53,7 +53,7 @@ jobs:
             --configuration=codeql
 
       - name: Upload Lint CodeQL
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@d186a2a36cc67bfa1b860e6170d37fb9634742c7 # v2
         with:
           sarif_file: reports/packages/nx-mesh/lint.sarif
           wait-for-processing: true

.github/workflows/__deploy-vercel.yml

@@ -41,13 +41,13 @@ jobs:
       url: ${{ steps.vercel.outputs.PREVIEW_URL }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3
         with:
           fetch-depth: 0
 
       - name: Deploy to Vercel
         id: vercel
-        uses: BetaHuhn/deploy-to-vercel-action@v1
+        uses: BetaHuhn/deploy-to-vercel-action@0f16bc3af7db7d5171bf68bff6f82679de195113 # v1
         with:
           GITHUB_DEPLOYMENT_ENV: ${{ inputs.name }}
           GITHUB_DEPLOYMENT: true

.github/workflows/__deploy.yml

@@ -38,7 +38,7 @@ jobs:
       suffix: ${{ steps.suffix.outputs.name }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3
         with:
           fetch-depth: 0
 

.github/workflows/__e2e.yml

@@ -50,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3
         with:
           fetch-depth: 0
 

.github/workflows/__generators.yml

@@ -61,7 +61,7 @@ jobs:
         nx_version: ${{fromJson(inputs.nx_version)}}
     steps:
       - name: Check out repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3
         with:
           fetch-depth: 0
 
@@ -73,7 +73,7 @@ jobs:
           skip_node_cache: 'true'
 
       - name: Restore PNPM cache
-        uses: actions/cache/restore@v3
+        uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
         id: pnpm-cache
         with:
           path: |
@@ -82,7 +82,7 @@ jobs:
             generators--pnpm--nx-${{ matrix.nx_version }}--type-${{ matrix.type }}--example-${{ matrix.example }}
 
       - name: Download Nx Mesh
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3
         with:
           name: nx-mesh
 
@@ -114,7 +114,7 @@ jobs:
           pnpm nx run ${{ matrix.example }}:build
 
       - name: Save PNPM cache
-        uses: actions/cache/save@v3
+        uses: actions/cache/save@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
         with:
           path: |
             ${{ steps.setup.outputs.pnpm_directory }}

.github/workflows/__lint.yml

@@ -61,7 +61,7 @@ jobs:
       hasAffectedLibs: ${{ steps.setup.outputs.hasAffectedLibs }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3
         with:
           fetch-depth: 0
 

.github/workflows/__test.yml

@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3
         with:
           fetch-depth: 0
 

.github/workflows/nx-latest.yml

@@ -38,15 +38,15 @@ jobs:
       isLatestChanged: ${{ steps.nx.outputs.isLatestChanged || steps.manual-nx.outputs.isLatestChanged }}
       latest_tag: ${{ steps.nx.outputs.release_tag || steps.manual-nx.outputs.release_tag }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3
 
       - name: Default nx version
         if: env.NX_VERSION == 'latest'
         run: |
           echo "15.0.0" > ${{ env.cache_file }}
 
       - name: Restore Nx version cache
-        uses: actions/cache/restore@v3
+        uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
         id: nx-version-cache
         if: env.NX_VERSION == 'latest'
         with:
@@ -88,7 +88,7 @@ jobs:
       # Save Cache
 
       - name: Save Nx version
-        uses: actions/cache/save@v3
+        uses: actions/cache/save@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
         if: (steps.nx.outputs.current_tag != steps.nx.outputs.release_tag) && env.NX_VERSION == 'latest'
         with:
           path: |
@@ -136,7 +136,7 @@ jobs:
     if: failure() && needs.nx-version.outputs.isLatestChanged == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3
 
       - name: Fetch release notes
         id: nx
@@ -150,7 +150,7 @@ jobs:
 
           echo $RELEASE_NOTES >> $GITHUB_STEP_SUMMARY
 
-      - uses: JasonEtco/create-an-issue@v2
+      - uses: JasonEtco/create-an-issue@e27dddc79c92bc6e4562f268fffa5ed752639abd # v2
         env:
           current_tag: ${{ needs.nx-version.outputs.current_tag }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/sponsors-label.yml

@@ -12,7 +12,7 @@ jobs:
     name: is-sponsor-label
     runs-on: ubuntu-latest
     steps:
-      - uses: JasonEtco/is-sponsor-label-action@v1
+      - uses: JasonEtco/is-sponsor-label-action@39d88e461a53ecb1b3c0a13673e6252f9976f2f5 # v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/stale.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: Sync Labels
-        uses: actions/stale@v8
+        uses: actions/stale@1160a2240286f5da8ec72b1c0816ce2481aabf84 # v8
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: