chore(deps): pin dependencies

.gitea/workflows/code-build.yml

@@ -18,7 +18,7 @@ jobs:
       fedora:   ${{ steps.check.outputs.fedora }}
       arch:     ${{ steps.check.outputs.arch }}
     steps:
-      - uses: https://gitea.com/actions/checkout@v4
+      - uses: https://gitea.com/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           fetch-depth: 0
 
@@ -63,7 +63,7 @@ jobs:
     needs: changes
     if: needs.changes.outputs.appimage == 'true' || github.event_name == 'workflow_dispatch'
     steps:
-      - uses: https://gitea.com/actions/checkout@v4
+      - uses: https://gitea.com/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Install required dependencies
         run: |
@@ -115,7 +115,7 @@ jobs:
           echo '%_topdir /home/rpmbuild' > /home/rpmbuild/.rpmmacros
 
       - name: Checkout repo
-        uses: https://gitea.com/actions/checkout@v4
+        uses: https://gitea.com/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Copy fedora-git.spec
         run: |
@@ -138,7 +138,7 @@ jobs:
     needs: changes
     if: needs.changes.outputs.arch == 'true' || github.event_name == 'workflow_dispatch'
     container:
-      image: archlinux:base-devel
+      image: archlinux:base-devel@sha256:8ccc930c28ab4f483ff9bc1b53957150fbe94afe48928ebb0b14a8af41c75023
       volumes:
         - /usr:/usr-host
         - /opt:/opt-host
@@ -178,7 +178,7 @@ jobs:
           su user -c "yes '' | makepkg --noconfirm -s -p PKGBUILD-git"
 
       - name: Checkout
-        uses: https://gitea.com/actions/checkout@v4
+        uses: https://gitea.com/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Upload Arch package
         uses: https://gitea.com/actions/gitea-upload-artifact@v4