Pin third party actions to commit hashes in composite actions

Author: camdecoster

.github/actions/setup-chrome/action.yml

@@ -9,7 +9,7 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - uses: browser-actions/setup-chrome@v2
+    - uses: browser-actions/setup-chrome@4f8e94349a351df0f048634f25fec36c3c91eded # v2
       id: setup-chrome
       with:
         chrome-version: ${{ inputs.chrome-version }}

.github/actions/setup-image-env/action.yml

@@ -12,17 +12,17 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - uses: actions/setup-python@v6
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
       with:
         python-version: ${{ inputs.python-version }}
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v7
+      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
       with:
         version: ${{ inputs.uv-version }}
 
     - name: Cache apt font packages
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       id: apt-cache
       with:
         path: ~/.cache/apt-fonts

.github/actions/setup-workspace/action.yml

@@ -9,7 +9,7 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - uses: actions/setup-node@v6
+    - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
       with:
         node-version: ${{ inputs.node-version }}
         cache: 'npm'
@@ -20,7 +20,7 @@ runs:
       env:
         NODE_OPTIONS: '--max-old-space-size=4096'
 
-    - uses: actions/download-artifact@v8
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
       with:
         name: build-output
         path: .