Pin GitHub actions dependency hashes

[patzielinski]

This PR pins GitHub actions dependency hashes. Might be a bit noisier with Dependabot PRs, but if so we can just batch them per week.

[JustinCappos]

If we're pinning to versions anyways, this seems like a security upgrade, but a readability downgrade. Anything else I'm missing?

…

On Mon, Nov 24, 2025 at 1:06 PM patzielinski ***@***.***> wrote: @patzielinski <https://github.com/patzielinski> requested your review on: #235 <#235> Pin GitHub actions dependency hashes. — Reply to this email directly, view it on GitHub <#235 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAGROD3MVFOZGAFJIVRHCKT36NCLVAVCNFSM6AAAAACNBXYE5WVHI2DSMVQWIX3LMV45UABCJFZXG5LFIV3GK3TUJZXXI2LGNFRWC5DJN5XDWMRRGE2DKNRRGQ2TQMQ> . You are receiving this because your review was requested.Message ID: <secure-systems-lab/secure-systems-lab.github. ***@***.***>

[patzielinski]

I'm going to look into this, I think there are some things we can do, but they'd have to be merged upstream first. For now, I think we can just merge this in.

[adityasaky]

I would consider if this is worth the extra dependabot PRs you're going to get. This is after all only the website repo, and not reeeallly critical. And nothing's running on any self managed compute.