chore(deps): pin dependencies

.github/workflows/ci.yml

@@ -11,9 +11,9 @@ jobs:
     name: Lint & Type Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: latest
 
@@ -36,7 +36,7 @@ jobs:
       postgres:
         # pgvector-enabled PostgreSQL 18 (matches dev/prod) so the feedback brain's
         # vector columns migrate and the db integration tests run
-        image: pgvector/pgvector:pg18
+        image: pgvector/pgvector:pg18@sha256:691673308c99d2161ba298736f3147f1f22d79de2fb7ec93ae9b4afcab870b62
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres
@@ -51,9 +51,9 @@ jobs:
     env:
       DATABASE_URL: postgres://postgres:postgres@localhost:5432/backfeed_test
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: latest
 

.github/workflows/cla.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   cla:
-    uses: omnidotdev/.github/.github/workflows/cla.yml@master
+    uses: omnidotdev/.github/.github/workflows/cla.yml@fff8e1bea2b720c122cc068021410fb53de73de9 # master
     permissions:
       actions: read
       contents: write