ci: migrate runs-on to Twilio runner labels + SHA-pin actions

.github/workflows/benchmark.yml

@@ -12,16 +12,16 @@ jobs:
           - master
           - ${{ github.sha }}
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-large
 
     steps:
       - name: Setup Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492  # v2
         with:
           go-version: "1.24"
 
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5  # v2
         with:
           ref: ${{ matrix.ref }}
 
@@ -30,34 +30,34 @@ jobs:
         run: go test -v -run '^$' -bench '(Marshal|Unmarshal)$/codeResponse' -benchmem -benchtime 3s -cpu 1 -count 6 ./json | tee bench.txt
 
       - name: Upload Benchmarks
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: ${{ matrix.ref }}
           path: bench.txt
 
   benchstat:
     needs: [benchmark]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-large
 
     steps:
       - name: Setup Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492  # v2
         with:
           go-version: "1.24"
 
       - name: Setup Benchstat
         run: go install golang.org/x/perf/cmd/benchstat@latest
 
       - name: Download Benchmark Results
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
         with:
           path: .
 
       - name: Run Benchstat
         run: benchstat ./master/bench.txt ./${{ github.sha }}/bench.txt | tee benchstat.txt
 
       - name: Upload Benchstat Results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: benchstat
           path: benchstat.txt

.github/workflows/test.yml

@@ -12,13 +12,13 @@ jobs:
           - "1.23"
           - "1.24"
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-large
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5  # v2
 
       - name: Setup Go ${{ matrix.go }}
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492  # v2
         with:
           go-version: ${{ matrix.go }}