pin workflows by sha

.github/workflows/test.yml

@@ -13,7 +13,7 @@ jobs:
 
     steps:
       - name: Install Nix
-        uses: cachix/install-nix-action@v30
+        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641
         with:
           enable_kvm: true
           extra_nix_config: |
@@ -22,7 +22,9 @@ jobs:
             extra-substituters = https://nixcache.cy7.sh
             extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@85e6279cec87321a52edac9c87bce653a07cf6c2
+        with:
+          persist-credentials: false
 
       - name: Run tests
         run: nix develop -c cargo test --verbose