chore(deps): pin dependencies

.github/workflows/apply-repo-settings.yaml

@@ -50,14 +50,14 @@ jobs:
     steps:
       - name: Checkout as GitHub App
         id: checkout
-        uses: nsheaps/github-actions/.github/actions/checkout-as-app@main
+        uses: nsheaps/github-actions/.github/actions/checkout-as-app@847e6e595f069e4d3dbaafe43913c3af9930d6da # main
         with:
           app-id: ${{ secrets.AUTOMATION_GITHUB_APP_ID }}
           private-key: ${{ secrets.AUTOMATION_GITHUB_APP_PRIVATE_KEY }}
 
       - name: Apply
         id: apply
-        uses: nsheaps/github-actions/.github/actions/apply-repo-settings@main
+        uses: nsheaps/github-actions/.github/actions/apply-repo-settings@847e6e595f069e4d3dbaafe43913c3af9930d6da # main
         with:
           token: ${{ steps.checkout.outputs.token }}
           dry-run: ${{ inputs.dry-run || false }}

.github/workflows/dispatch-review.yaml

@@ -61,7 +61,7 @@ jobs:
     # on the next PR event in repos using this template. This is intentional —
     # operators who need pinned stability should replace @main with a commit SHA
     # and update it in lock-step with plugin version bumps.
-    uses: nsheaps/agents/.github/workflows/review-dispatch.yaml@main
+    uses: nsheaps/agents/.github/workflows/review-dispatch.yaml@16219f99ffa59e5c46e57c7839a51f7fc912b84e # main
     # secrets: inherit doesn't pass cross-repo (GitHub limitation).
     secrets:
       AUTOMATION_GITHUB_APP_ID: ${{ secrets.AUTOMATION_GITHUB_APP_ID }}

.github/workflows/pr-status-dispatch.yaml

@@ -41,7 +41,7 @@ jobs:
     steps:
       - name: Authenticate as GitHub App
         id: app-token
-        uses: nsheaps/github-actions/.github/actions/github-app-auth@main
+        uses: nsheaps/github-actions/.github/actions/github-app-auth@847e6e595f069e4d3dbaafe43913c3af9930d6da # main
         with:
           app-id: ${{ secrets.AUTOMATION_GITHUB_APP_ID }}
           private-key: ${{ secrets.AUTOMATION_GITHUB_APP_PRIVATE_KEY }}