chore: pin workflows dependencies

[step-security-bot]

Summary

This pull request is created by Secure Repo at the request of @prisis. Please merge the Pull Request to incorporate the requested changes. Please tag @prisis on your message if you have any questions related to the PR. You can also engage with the StepSecurity team by tagging @step-security-bot.

Security Fixes

Pinned Dependencies

GitHub Action tags and Docker tags are mutatble. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.

• GitHub Security Guide
• The Open Source Security Foundation (OpenSSF) Security Guide

Feedback

For bug reports, feature requests, and general feedback; please create an issue in step-security/secure-repo. To create such PRs, please visit https://app.stepsecurity.io/securerepo.

Signed-off-by: StepSecurity Bot bot@stepsecurity.io

[ST-DDT]

Please also add the required renovate config.

[codecov]

Codecov Report

Merging #2208 (a9e1443) into next (82f1fd3) will decrease coverage by 0.01%.
The diff coverage is n/a.

Additional details and impacted files

@@            Coverage Diff             @@
##             next    #2208      +/-   ##
==========================================
- Coverage   99.60%   99.59%   -0.01%     
==========================================
  Files        2641     2641              
  Lines      245760   245760              
  Branches     1157     1155       -2     
==========================================
- Hits       244783   244766      -17     
- Misses        950      967      +17     
  Partials       27       27              

see 1 file with indirect coverage changes

[varunsh-coder]

Please also add the required renovate config.

I am not an expert in renovate config, but I believe the default config:base should cause Actions to be updated, so no change should be needed to the renovate config. I found a few examples, and this is one of them:
https://github.com/target/flottbot/blob/main/.github/renovate.json
target/flottbot#465

[prisis]

It looks like its there renovatebot/renovate#12488 but somehow im not sure myself, so i added it to the config

[ST-DDT]

Team Decision

We will give this a try.