Pin dependencies

.github/workflows/validate-charts.yml

@@ -15,7 +15,7 @@ jobs:
       any-install: ${{ steps.detect.outputs.any-install }}
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - name: "Detect changed charts"
@@ -116,11 +116,11 @@ jobs:
         chart: ${{ fromJSON(needs.detect-changed-charts.outputs.charts) }}
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - name: "Install Helm"
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
       # Both steps below refuse to run while a chart declares a dependency that
       # is not in its charts/ directory - lint with "[WARNING] chart directory
       # is missing these dependencies", package with "found in Chart.yaml, but
@@ -167,9 +167,9 @@ jobs:
     # build-chart, so it adds no wall-clock time to the pipeline.
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: "Install Helm"
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
       - name: "Render every chart with bare integer quantities"
         run: ci/run-quantity-render-test.sh
 
@@ -197,9 +197,9 @@ jobs:
       TRIVY_CONFIG_MODE: report
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: "Install Helm"
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
       # A plain release download rather than aquasecurity/setup-trivy, and the
       # reason is measured on the Gitea probe PR of #225, not assumed. That
       # action runs actions/checkout against aquasecurity/trivy on github.com