Pin all the action deps to SHA (#531)

.github/workflows/test.yml

@@ -19,16 +19,16 @@ jobs:
     runs-on: ${{ matrix.platform }}
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6.0.2
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with: 
         submodules: true
     - name: Setup node
-      uses: actions/setup-node@v6.2.0
+      uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
       with:
-        node-version: 24.13.1
-        cache: 'npm'
+        node-version-file: ".node-version"
+        package-manager-cache: false
     - name: install Rust stable
-      uses: dtolnay/rust-toolchain@stable
+      uses: dtolnay/rust-toolchain@stable # They use branch based releases
       with:
         targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
     - name: Install dependencies (ubuntu only)
@@ -41,7 +41,7 @@ jobs:
     - name: Install tauri dependencies
       run: npm ci
     - name: Build desktop app with Tauri
-      uses: tauri-apps/tauri-action@v0.6.1
+      uses: tauri-apps/tauri-action@73fb865345c54760d875b94642314f8c0c894afa # v0.6.1
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}