Pin third-party actions

.github/workflows/diffcalc.yml

@@ -111,7 +111,7 @@ jobs:
     steps:
       - name: Check permissions
         if: ${{ github.event_name != 'workflow_dispatch' }}
-        uses: actions-cool/check-user-permission@v2
+        uses: actions-cool/check-user-permission@a0668c9aec87f3875fc56170b6452a453e9dd819 # v2.2.0
         with:
           require: 'write'
 
@@ -122,7 +122,7 @@ jobs:
     if: ${{ github.event_name == 'issue_comment' && github.event.issue.pull_request }}
     steps:
       - name: Create comment
-        uses: thollander/actions-comment-pull-request@v2
+        uses: thollander/actions-comment-pull-request@363c6f6eae92cc5c3a66e95ba016fc771bb38943 # v2.4.2
         with:
           comment_tag: ${{ env.COMMENT_TAG }}
           message: |
@@ -136,7 +136,7 @@ jobs:
     runs-on: self-hosted
     timeout-minutes: 50400 # 35 days, the maximum for jobs on self-hosted runners.
     steps:
-      - uses: ahmadnassri/action-workflow-queue@v1
+      - uses: ahmadnassri/action-workflow-queue@f547ac848c16a9bb1b2ed4a850e0cc5098af2cf8 # v1.1.5
         with:
           timeout: 2147483647 # Around 24 days - the maximum supported by JS setTimeout().
           delay: 120000 # Poll every 2 minutes - the API limit seems fairly low on this one.
@@ -261,7 +261,7 @@ jobs:
 
       - name: Restore cache
         id: restore-cache
-        uses: maxnowack/local-cache@v1
+        uses: maxnowack/local-cache@038cc090b52e4f205fbc468bf5b0756df6f68775 # v1
         with:
           path: ${{ steps.query.outputs.DATA_NAME }}.tar.bz2
           key: ${{ steps.query.outputs.DATA_NAME }}
@@ -292,7 +292,7 @@ jobs:
 
       - name: Restore cache
         id: restore-cache
-        uses: maxnowack/local-cache@v1
+        uses: maxnowack/local-cache@038cc090b52e4f205fbc468bf5b0756df6f68775 # v1
         with:
           path: ${{ steps.query.outputs.DATA_NAME }}.tar.bz2
           key: ${{ steps.query.outputs.DATA_NAME }}
@@ -356,7 +356,7 @@ jobs:
     steps:
       - name: Update comment on success
         if: ${{ needs.generator.result == 'success' }}
-        uses: thollander/actions-comment-pull-request@v2
+        uses: thollander/actions-comment-pull-request@363c6f6eae92cc5c3a66e95ba016fc771bb38943 # v2.4.2
         with:
           comment_tag: ${{ env.COMMENT_TAG }}
           mode: upsert
@@ -367,7 +367,7 @@ jobs:
 
       - name: Update comment on failure
         if: ${{ needs.generator.result == 'failure' }}
-        uses: thollander/actions-comment-pull-request@v2
+        uses: thollander/actions-comment-pull-request@363c6f6eae92cc5c3a66e95ba016fc771bb38943 # v2.4.2
         with:
           comment_tag: ${{ env.COMMENT_TAG }}
           mode: upsert
@@ -377,7 +377,7 @@ jobs:
 
       - name: Update comment on cancellation
         if: ${{ needs.generator.result == 'cancelled' }}
-        uses: thollander/actions-comment-pull-request@v2
+        uses: thollander/actions-comment-pull-request@363c6f6eae92cc5c3a66e95ba016fc771bb38943 # v2.4.2
         with:
           comment_tag: ${{ env.COMMENT_TAG }}
           mode: delete