pin workflows by sha

.github/workflows/build.yml

@@ -25,7 +25,7 @@ jobs:
         run: echo -n "${{ secrets.NIX_CACHE_SECRET_KEY }}" | xxd -p -r > ${{ runner.temp }}/cache-priv-key.pem
 
       - name: Install Nix
-        uses: cachix/install-nix-action@v30
+        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641
         with:
           enable_kvm: true
           extra_nix_config: |
@@ -35,8 +35,7 @@ jobs:
             extra-substituters = https://nixcache.cy7.sh
             extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
 
-      - name: Sync repository
-        uses: actions/checkout@v4
+      - uses: actions/checkout@85e6279cec87321a52edac9c87bce653a07cf6c2
         with:
           persist-credentials: false
 
@@ -54,7 +53,7 @@ jobs:
         run: nix run github:nixos/nixpkgs#gnutar hcvf result.tar result
 
       - name: upload result
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@6027e3dd177782cd8ab9af838c04fd81a07f1d47
         with:
           name: ${{ matrix.os }}.tar
           path: result.tar