Pin dependencies

Author: renovate[bot]

.github/actions/deploy-tinybird/action.yml

@@ -36,7 +36,7 @@ runs:
       working-directory: ghost/core/core/server/data/tinybird
 
     - name: Send slack notification
-      uses: slackapi/slack-github-action@v2.1.1
+      uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a # v2.1.1
       if: always()
       with:
         webhook: ${{ inputs.slack-webhook }}

.github/actions/load-docker-image/action.yml

@@ -17,7 +17,7 @@ runs:
   steps:
     - name: Download image artifact (artifact)
       if: inputs.use-artifact == 'true'
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: ${{ inputs.artifact-name }}
 
@@ -34,7 +34,7 @@ runs:
 
     - name: Log in to GitHub Container Registry
       if: inputs.use-artifact == 'false'
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
       with:
         registry: ghcr.io
         username: ${{ github.actor }}

.github/actions/restore-cache/action.yml

@@ -10,7 +10,7 @@ runs:
   steps:
     - name: Check dependency cache
       id: dep-cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: ${{ env.CACHED_DEPENDENCY_PATHS }}
         key: ${{ env.DEPENDENCY_CACHE_KEY }}
@@ -26,7 +26,7 @@ runs:
     - name: Check dependency cache (retry)
       id: dep-cache-retry-attempt
       if: steps.dep-cache.outputs.cache-hit != 'true'
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: ${{ env.CACHED_DEPENDENCY_PATHS }}
         key: ${{ env.DEPENDENCY_CACHE_KEY }}

.github/actions/setup-playwright/action.yml

@@ -15,7 +15,7 @@ runs:
       shell: bash
       run: echo "version=$(node -p "require('@playwright/test/package.json').version")" >> $GITHUB_OUTPUT
 
-    - uses: actions/cache@v4
+    - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       name: Check if Playwright browser is cached
       id: playwright-cache
       with: