Use full commit SHA hash for GitHub Action dependencies

Author: xalopp

.github/workflows/ci.yml

@@ -16,7 +16,8 @@ jobs:
       - name: Check out repository code
         uses: actions/checkout@v4
       - name: Install PHP
-        uses: shivammathur/setup-php@v2
+        # uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1
         with:
           php-version: '8.1'
           coverage: 'none'
@@ -66,7 +67,8 @@ jobs:
       - name: Check out repository code
         uses: actions/checkout@v4
       - name: Install PHP
-        uses: shivammathur/setup-php@v2
+        # uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1
         with:
           coverage: 'xdebug'
           php-version: ${{ matrix.php_version }}
@@ -102,17 +104,20 @@ jobs:
         run: php vendor/bin/phpunit --coverage-clover=coverage.xml --coverage-cobertura=cobertura.xml --log-junit=junit.xml
       - name: Upload coverage to Codecov
         if: ${{ matrix.os != 'windows-latest' && matrix.php_version == '8.1' && matrix.dependencies_level != '--prefer-lowest' }}
-        uses: codecov/codecov-action@v5
+        # uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
       - name: Upload test results to Codecov
         if: ${{ matrix.os != 'windows-latest' && matrix.php_version == '8.1' && matrix.dependencies_level != '--prefer-lowest' }}
-        uses: codecov/test-results-action@v1
+        # uses: codecov/test-results-action@v1
+        uses: codecov/test-results-action@7024b0ed56bb02ec9dd191175a599a93803f0474
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
       - name: Upload coverage to Qlty
         if: ${{ matrix.os != 'windows-latest' && matrix.php_version == '8.1' && matrix.dependencies_level != '--prefer-lowest' }}
-        uses: qltysh/qlty-action/coverage@v1
+        # uses: qltysh/qlty-action/coverage@v1
+        uses: qltysh/qlty-action/coverage@a2277a908db90c4c868832fb9204521fb940fdb4
         with:
           token: ${{ secrets.QLTY_COVERAGE_TOKEN }}
           files: cobertura.xml
@@ -126,10 +131,12 @@ jobs:
     if: always()
     runs-on: ubuntu-latest
     steps:
-      - uses: technote-space/workflow-conclusion-action@v3
+      # - uses: technote-space/workflow-conclusion-action@v3
+      - uses: technote-space/workflow-conclusion-action@45ce8e0eb155657ab8ccf346ade734257fd196a5
       - name: Post to a Slack channel
         id: slack
-        uses: slackapi/slack-github-action@v1.23.0
+        # uses: slackapi/slack-github-action@v1.23.0
+        uses: slackapi/slack-github-action@007b2c3c751a190b6f0f040e47ed024deaa72844
         with:
           # Slack channel id, channel name, or user id to post a message.
           # See also: https://api.slack.com/methods/chat.postMessage#channels