Pin dependencies

Author: renovate[bot]

.github/workflows/build.yml

@@ -21,16 +21,16 @@ jobs:
       #     remove-docker-images: 'true'
       #     remove-large-packages: 'true'
       #     remove-cached-tools: 'true'
-      - uses: actions/checkout@v4.2.2
-      - uses: DeterminateSystems/nix-installer-action@v16
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: DeterminateSystems/nix-installer-action@e50d5f73bfe71c2dd0aa4218de8f4afa59f8f81d # v16
         with:
           extra-conf: |
             build-dir = /opt
             download-buffer-size = 524288000
             extra-substituters = https://nix-community.cachix.org
             extra-trusted-public-keys = nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
       - name: Setup Attic cache
-        uses: ryanccn/attic-action@v0.3.1
+        uses: ryanccn/attic-action@3354ae812cb672e1381be4c7914204c44db53866 # v0.3.1
         with:
           endpoint: ${{ vars.ATTIC_ENDPOINT }}
           cache: ${{ vars.ATTIC_CACHE }}