Pin dependencies

.github/workflows/codeql.yml

@@ -32,13 +32,13 @@ jobs:
           distribution: temurin
           cache: maven
       - name: Initialize CodeQL
-        uses: github/codeql-action/[email protected]
+        uses: github/codeql-action/init@d186a2a36cc67bfa1b860e6170d37fb9634742c7 # v2.2.11
         with:
           languages: ${{ matrix.language }}
       - name: Perform minimal build
         if: matrix.language == 'java'
         run: mvn -T1C clean install -DskipTests -Dverification.skip
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/[email protected]
+        uses: github/codeql-action/analyze@d186a2a36cc67bfa1b860e6170d37fb9634742c7 # v2.2.11
         with:
           category: /language:${{ matrix.language }}

.github/workflows/deploy-website.yaml

@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           persist-credentials: false
-      - uses: ruby/[email protected]
+      - uses: ruby/setup-ruby@c7079efafd956afb5d823e8999c2506e1053aefa # v1.126.0
         with:
           working-directory: ./website
           bundler-cache: true

.github/workflows/openssf-scorecard.yml

@@ -31,6 +31,6 @@ jobs:
           results_format: sarif
           publish_results: ${{ github.ref == 'refs/heads/master' }}
       - name: Update GitHub's code scanning dashboard
-        uses: github/codeql-action/[email protected]
+        uses: github/codeql-action/upload-sarif@d186a2a36cc67bfa1b860e6170d37fb9634742c7 # v2.2.11
         with:
           sarif_file: results.sarif