chore: pin GitHub Actions to SHA

.github/workflows/deploy-benchmark-preview.yml

@@ -14,8 +14,8 @@ jobs:
       pull-requests: write # for FirebaseExtended/action-hosting-deploy to comment on PRs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: FirebaseExtended/action-hosting-deploy@v0
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
+      - uses: FirebaseExtended/action-hosting-deploy@0cbcac4740c2bfb00d632f0b863b57713124eb5a # v0.9.0
         with:
           repoToken: "${{ secrets.GITHUB_TOKEN }}"
           firebaseServiceAccount: "${{ secrets.FIREBASE_SERVICE_ACCOUNT_JSTENSORFLOW }}"

.github/workflows/deploy-benchmark-prod.yml

@@ -16,8 +16,8 @@ jobs:
       pull-requests: write # for FirebaseExtended/action-hosting-deploy to comment on PRs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: FirebaseExtended/action-hosting-deploy@v0
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
+      - uses: FirebaseExtended/action-hosting-deploy@0cbcac4740c2bfb00d632f0b863b57713124eb5a # v0.9.0
         with:
           repoToken: "${{ secrets.GITHUB_TOKEN }}"
           firebaseServiceAccount: "${{ secrets.FIREBASE_SERVICE_ACCOUNT_JSTENSORFLOW }}"

.github/workflows/stale.yaml

@@ -30,7 +30,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-    - uses: 'actions/stale@v7'
+    - uses: 'actions/stale@6f05e4244c9a0b2ed3401882b05d701dd0a7289b # v7.0.0'
       with:
         # Comma separated list of labels that can be assigned to issues to exclude them from being marked as stale.
         exempt-issue-labels: 'override-stale'

.github/workflows/tfjs-ci.yml

@@ -14,17 +14,17 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: bazel-contrib/setup-bazel@0.14.0
+      - uses: bazel-contrib/setup-bazel@5483a91b6e3ffac6092848f1dd7eafcfad203d80 # 0.14.0
         with:
           # Avoid downloading Bazel every time.
           bazelisk-cache: true
           # Store build cache per workflow.
           disk-cache: ${{ github.workflow }}-cpu
           # Share repository cache between workflows.
           repository-cache: true
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: Test TFJS CPU
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20.x
           cache: 'npm'
@@ -35,17 +35,17 @@ jobs:
   test-gpu-mac:
     runs-on: macos-latest-xlarge # consumer gpu
     steps:
-      - uses: bazel-contrib/setup-bazel@0.14.0
+      - uses: bazel-contrib/setup-bazel@5483a91b6e3ffac6092848f1dd7eafcfad203d80 # 0.14.0
         with:
           # Avoid downloading Bazel every time.
           bazelisk-cache: true
           # Store build cache per workflow.
           disk-cache: ${{ github.workflow }}-gpu-mac
           # Share repository cache between workflows.
           repository-cache: true
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: Test TFJS GPU
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20.x
           cache: 'npm'

.github/workflows/tfjs-nightly-release-and-publish-test.yml

@@ -13,17 +13,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.14.0
+        uses: bazel-contrib/setup-bazel@5483a91b6e3ffac6092848f1dd7eafcfad203d80 # 0.14.0
         with:
           bazelisk-cache: true
           disk-cache: ${{ github.workflow }}-nightly-release
           repository-cache: true
 
       - name: Setup Node.js and Yarn
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20.x # Using a current LTS version of Node.js
           cache: 'yarn'

.github/workflows/tfjs-release-branch-publish-test.yml

@@ -14,17 +14,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.14.0
+        uses: bazel-contrib/setup-bazel@5483a91b6e3ffac6092848f1dd7eafcfad203d80 # 0.14.0
         with:
           bazelisk-cache: true
           disk-cache: ${{ github.workflow }}-release-e2e
           repository-cache: true
 
       - name: Setup Node.js and Yarn
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20.x
           cache: 'yarn' # Changed from 'npm' in example to 'yarn' as primary tool here