chore(deps): Pin dependencies (#870)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://redirect.github.com/actions/checkout) |
action | pinDigest | → `de0fac2` |
|
[actions/github-script](https://redirect.github.com/actions/github-script)
| action | pinDigest | → `ed59741` |
|
[actions/setup-python](https://redirect.github.com/actions/setup-python)
| action | pinDigest | → `a309ff8` |
|
[amannn/action-semantic-pull-request](https://redirect.github.com/amannn/action-semantic-pull-request)
| action | pinDigest | → `48f2562` |
| [azure/setup-helm](https://redirect.github.com/azure/setup-helm) |
action | pinDigest | → `1a275c3` |
|
[googleapis/release-please-action](https://redirect.github.com/googleapis/release-please-action)
| action | pinDigest | → `16a9c90` |
|
[helm/chart-releaser-action](https://redirect.github.com/helm/chart-releaser-action)
| action | pinDigest | → `cae68fe` |
|
[helm/chart-testing-action](https://redirect.github.com/helm/chart-testing-action)
| action | pinDigest | → `6ec842c` |
|
[stefanzweifel/git-auto-commit-action](https://redirect.github.com/stefanzweifel/git-auto-commit-action)
| action | pinDigest | → `04702ed` |

---

### Configuration

📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, on day
1 of the month ( * 0-3 1 * * ) (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My42My4wIiwidXBkYXRlZEluVmVyIjoiNDMuNjMuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Author: cq-bot

.github/workflows/auto_update_docs.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           token: ${{ secrets.GH_CQ_BOT }}
 
@@ -22,15 +22,15 @@ jobs:
           docker run --rm --volume "$(pwd):/helm-docs" -u "$(id -u)" jnorwood/helm-docs:v1.11.0
 
       - name: Get component from branch name
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         id: component
         with:
           result-encoding: string
           script: |
             const lastPartOfBranch = context.ref.split('-').pop();
             return lastPartOfBranch;
 
-      - uses: stefanzweifel/git-auto-commit-action@v7
+      - uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7
         with:
           file_pattern: charts/${{ steps.component.outputs.result }}/README.md
           commit_message: "chore: Update docs"

.github/workflows/lint_test.yml

@@ -10,24 +10,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
           version: v3.8.1
 
       # Python is required because `ct lint` runs Yamale (https://github.com/23andMe/Yamale) and
       # yamllint (https://github.com/adrienverge/yamllint) which require Python
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: 3.14.3
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.8.0
+        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0
 
       - name: Run chart-testing (lint PR)
         if: ${{ !startsWith(github.head_ref || '', 'release-please-') }}

.github/workflows/pr_title.yml

@@ -16,7 +16,7 @@ jobs:
     steps:
       # Please look up the latest version from
       # https://github.com/amannn/action-semantic-pull-request/releases
-      - uses: amannn/action-semantic-pull-request@v6
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/release_please.yml

@@ -12,13 +12,13 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4
         id: release
         with:
           token: ${{ secrets.GH_CQ_BOT }}
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         if: |
           startsWith(github.event.head_commit.message, 'chore(main): Release')
         with:
@@ -34,7 +34,7 @@ jobs:
       - name: Install Helm
         if: |
           startsWith(github.event.head_commit.message, 'chore(main): Release')
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
         with:
           version: v3.8.1
 
@@ -49,14 +49,14 @@ jobs:
       - name: Run chart-releaser
         if: |
           startsWith(github.event.head_commit.message, 'chore(main): Release')
-        uses: helm/chart-releaser-action@v1.7.0
+        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
         with:
           skip_existing: true
         env:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
 
       - name: Get PR data
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         if: |
           startsWith(github.event.head_commit.message, 'chore(main): Release')
         id: get_pr_data
@@ -71,7 +71,7 @@ jobs:
             ).data[0];
 
       - name: Update PR labels
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         if: |
           startsWith(github.event.head_commit.message, 'chore(main): Release')
         with: