chore(deps): update github-actions (#13454)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/benchmark.yml

@@ -21,14 +21,14 @@ jobs:
       MAIN-BENCH: ${{ steps.benchmark-main.outputs.BENCH_RESULT }}
     steps:
       - name: Check if user has write access
-        uses: lannonbr/repo-permission-check-action@2.0.2
+        uses: lannonbr/repo-permission-check-action@2bb8c89ba8bf115c4bfab344d6a6f442b24c9a1f # 2.0.2
         with:
           permission: write
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       # https://github.com/actions/checkout/issues/331#issuecomment-1438220926
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
           ref: refs/pull/${{ github.event.issue.number }}/head
@@ -37,7 +37,7 @@ jobs:
         uses: pnpm/action-setup@v3
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 22
           cache: "pnpm"
@@ -70,7 +70,7 @@ jobs:
         shell: bash
 
       # main benchmark
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
           ref: "main"
@@ -101,7 +101,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Comment PR
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
         continue-on-error: true
         with:
           issue-number: ${{ github.event.issue.number }}

.github/workflows/check.yml

@@ -28,13 +28,13 @@ jobs:
     timeout-minutes: 7
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
         uses: pnpm/action-setup@v3
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 22
           cache: "pnpm"

.github/workflows/ci.yml

@@ -47,13 +47,13 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
         uses: pnpm/action-setup@v3
 
       - name: Setup node@${{ matrix.NODE_VERSION }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: ${{ matrix.NODE_VERSION }}
           cache: "pnpm"
@@ -77,13 +77,13 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
         uses: pnpm/action-setup@v3
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 22
           cache: "pnpm"
@@ -122,13 +122,13 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
         uses: pnpm/action-setup@v3
 
       - name: Setup node@${{ matrix.NODE_VERSION }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: ${{ matrix.NODE_VERSION }}
           cache: "pnpm"
@@ -159,13 +159,13 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
         uses: pnpm/action-setup@v3
 
       - name: Setup node@${{ matrix.NODE_VERSION }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: ${{ matrix.NODE_VERSION }}
           cache: "pnpm"
@@ -195,19 +195,19 @@ jobs:
         run: git config --global core.autocrlf false
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
         uses: pnpm/action-setup@v3
 
       - name: Setup node@${{ matrix.NODE_VERSION }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: ${{ matrix.NODE_VERSION }}
           cache: "pnpm"
 
       - name: Checkout docs
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: withastro/docs
           path: smoke/docs
@@ -232,7 +232,7 @@ jobs:
 
       - name: Check if docs changed
         id: changes
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         with:
           filters: |
             docs:

.github/workflows/cleanup-cache.yml

@@ -12,11 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Cleanup caches older than 5 days
         if: github.event_name == 'schedule'
-        uses: MyAlbum/purge-cache@v2
+        uses: MyAlbum/purge-cache@881eb5957687193fa612bf74c0042adc78ea5e54 # v2.2.0
         with:
           max-age: 432000
 

.github/workflows/continuous_benchmark.yml

@@ -29,13 +29,13 @@ jobs:
       pull-requests: write
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
         uses: pnpm/action-setup@v3
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 22
           cache: "pnpm"
@@ -47,7 +47,7 @@ jobs:
         run: pnpm run build
         
       - name: Run the benchmarks
-        uses: CodSpeedHQ/action@63ae6025a0ffee97d7736a37c9192dbd6ed4e75f # v3.4.0
+        uses: CodSpeedHQ/action@0010eb0ca6e89b80c88e8edaaa07cfe5f3e6664d # v3.5.0
         timeout-minutes: 30
         with:
           working-directory: ./benchmark

.github/workflows/examples-deploy.yml

@@ -15,7 +15,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Send a POST request to Netlify to rebuild preview.astro.new
         run: 'curl -X POST -d {} ${{ env.BUILD_HOOK }}'
         env:

.github/workflows/issue-labeled.yml

@@ -11,7 +11,7 @@ jobs:
     steps:
       - name: remove triage
         if: contains(github.event.label.description, '(priority)') && contains(github.event.issue.labels.*.name, 'needs triage')
-        uses: actions-cool/issues-helper@v3
+        uses: actions-cool/issues-helper@a610082f8ac0cf03e357eb8dd0d5e2ba075e017e # v3.6.0
         with:
           actions: "remove-labels"
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -20,7 +20,7 @@ jobs:
 
       - name: needs repro
         if: github.event.label.name == 'needs repro'
-        uses: actions-cool/issues-helper@v3
+        uses: actions-cool/issues-helper@a610082f8ac0cf03e357eb8dd0d5e2ba075e017e # v3.6.0
         with:
           actions: "create-comment, remove-labels"
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -30,7 +30,7 @@ jobs:
           labels: "needs triage"
       - name: wontfix
         if: github.event.label.name == 'wontfix'
-        uses: actions-cool/issues-helper@v3
+        uses: actions-cool/issues-helper@a610082f8ac0cf03e357eb8dd0d5e2ba075e017e # v3.6.0
         with:
           actions: "create-comment, close-issue"
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/issue-needs-repro.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: needs repro
-        uses: actions-cool/issues-helper@v3
+        uses: actions-cool/issues-helper@a610082f8ac0cf03e357eb8dd0d5e2ba075e017e # v3.6.0
         with:
           actions: "close-issues"
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/issue-opened.yml

@@ -12,7 +12,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             github.rest.issues.addLabels({

.github/workflows/preview-release.yml

@@ -37,13 +37,13 @@ jobs:
       - name: Disable git crlf
         run: git config --global core.autocrlf false
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       
       - name: Setup PNPM
         uses: pnpm/action-setup@v3
   
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 22
           cache: "pnpm"
@@ -55,7 +55,7 @@ jobs:
         run: pnpm run build
 
       - name: Remove Preview Label
-        uses: actions-ecosystem/action-remove-labels@v1
+        uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 # v1.3.0
         with:
           labels: "pr: preview"
         

.github/workflows/release.yml

@@ -27,13 +27,13 @@ jobs:
       contents: write
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
         uses: pnpm/action-setup@v3
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 22
           cache: "pnpm"
@@ -46,7 +46,7 @@ jobs:
 
       - name: Create Release Pull Request or Publish
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@06245a4e0a36c064a573d4150030f5ec548e4fcc # v1.4.10
         with:
           # Note: pnpm install after versioning is necessary to refresh lockfile
           version: pnpm run version
@@ -70,6 +70,6 @@ jobs:
         if: steps.changesets.outputs.published == 'true'
         env:
           DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.3.2
+        uses: Ilshidur/action-discord@0c4b27844ba47cb1c7bee539c8eead5284ce9fa9 # 0.3.2
         with:
           args: "${{ steps.message.outputs.DISCORD_MESSAGE }}"

.github/workflows/scripts.yml

@@ -24,10 +24,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Checkout Main into tmp
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: main
           path: main
@@ -36,7 +36,7 @@ jobs:
         uses: pnpm/action-setup@v3
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 22
           cache: "pnpm"
@@ -45,7 +45,7 @@ jobs:
         run: pnpm install
 
       - name: Check Bundle Size
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             const { default: script } = await import('${{ github.workspace }}/.github/scripts/bundle-size.mjs')

.github/workflows/sync-examples.yml

@@ -31,13 +31,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 2 # fetch 2 to compare with previous commit for changes
           ref: ${{ inputs.checkout-ref }}
 
       - name: Detect changesets
-        uses: bluwy/detect-changesets-action@v1
+        uses: bluwy/detect-changesets-action@41d6432bd7bc24b3539228091f88879a18cee39b # v1
         id: detect
 
       - name: Get pre mode of changesets
@@ -53,7 +53,7 @@ jobs:
 
       - name: Sync stable to latest and examples/* branches
         if: steps.detect.outputs.has-changesets == 'false' && github.ref == 'refs/heads/main' && steps.pre.outputs.value == ''
-        uses: bluwy/auto-branch-sync-action@v1
+        uses: bluwy/auto-branch-sync-action@a72b09dc60911f56a1e7093a069f24480ca3d2ab # v1.0.1
         with:
           map: |
             / -> latest
@@ -63,7 +63,7 @@ jobs:
 
       - name: Sync prerelease to alpha branch
         if: steps.detect.outputs.has-changesets == 'false' && steps.pre.outputs.value == 'alpha'
-        uses: bluwy/auto-branch-sync-action@v1
+        uses: bluwy/auto-branch-sync-action@a72b09dc60911f56a1e7093a069f24480ca3d2ab # v1.0.1
         with:
           map: / -> alpha
           skip-unchanged-check: ${{ inputs.skip-unchanged-check == true }}
@@ -71,7 +71,7 @@ jobs:
 
       - name: Sync prerelease to beta branch
         if: steps.detect.outputs.has-changesets == 'false' && steps.pre.outputs.value == 'beta'
-        uses: bluwy/auto-branch-sync-action@v1
+        uses: bluwy/auto-branch-sync-action@a72b09dc60911f56a1e7093a069f24480ca3d2ab # v1.0.1
         with:
           map: / -> beta
           skip-unchanged-check: ${{ inputs.skip-unchanged-check == true }}
@@ -79,7 +79,7 @@ jobs:
 
       - name: Sync prerelease to rc branch
         if: steps.detect.outputs.has-changesets == 'false' && steps.pre.outputs.value == 'rc'
-        uses: bluwy/auto-branch-sync-action@v1
+        uses: bluwy/auto-branch-sync-action@a72b09dc60911f56a1e7093a069f24480ca3d2ab # v1.0.1
         with:
           map: / -> rc
           skip-unchanged-check: ${{ inputs.skip-unchanged-check == true }}

.github/workflows/test-hosts.yml

@@ -19,13 +19,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup PNPM
         uses: pnpm/action-setup@v3
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
         with:
           node-version: 22
           cache: 'pnpm'