ci: lock workflow dependencies with gh actions-lock

.github/workflows/actions.lock

@@ -0,0 +1,45 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/ci.yaml':
+        - 'actions-rs/cargo@v1.0.3'
+        - 'actions-rs/toolchain@v1.0.7'
+        - 'actions/checkout@v3.7.0'
+        - 'crate-ci/typos@master'
+    '.github/workflows/publish.yaml':
+        - 'actions/checkout@v3.7.0'
+        - 'js-devtools/npm-publish@v1.4.3'
+        - 'phips28/gh-action-bump-version@master'
+dependencies:
+    'actions-rs/cargo@v1.0.3':
+        ref: 'v1.0.3'
+        commit: 'sha1-844f36862e911db73fe0815f00a4a2602c279505'
+        owner_id: 55226457
+        repo_id: 208143758
+    'actions-rs/toolchain@v1.0.7':
+        ref: 'v1.0.7'
+        commit: 'sha1-16499b5e05bf2e26879000db0c1d13f7e13fa3af'
+        owner_id: 55226457
+        repo_id: 208060770
+    'actions/checkout@v3.7.0':
+        ref: 'v3.7.0'
+        commit: 'sha1-a37ce9120846195fa4ece8f58b268e6043cb2f26'
+        owner_id: 44036562
+        repo_id: 197814629
+    'crate-ci/typos@master':
+        ref: 'master'
+        commit: 'sha1-b41eb62e9a8096c9ba6636e2365d3f56018a203c'
+        owner_id: 36412122
+        repo_id: 181782286
+    'js-devtools/npm-publish@v1.4.3':
+        ref: 'v1.4.3'
+        commit: 'sha1-0f451a94170d1699fd50710966d48fb26194d939'
+        owner_id: 43779360
+        repo_id: 235231513
+    'phips28/gh-action-bump-version@master':
+        ref: 'master'
+        commit: 'sha1-63bc5b97aade4390bf3f33416b8adb891a0f28d7'
+        owner_id: 3694800
+        repo_id: 217743538

.github/workflows/ci.yaml

@@ -10,37 +10,37 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3.7.0
 
       - name: Check typos
         uses: crate-ci/typos@master
 
       - name: Install Rust toolchain
-        uses: actions-rs/toolchain@v1
+        uses: actions-rs/toolchain@v1.0.7
         with:
           profile: minimal
           toolchain: stable
           override: true
           components: rustfmt, clippy
 
       - name: Run cargo build
-        uses: actions-rs/cargo@v1
+        uses: actions-rs/cargo@v1.0.3
         with:
           command: build
 
       - name: Run cargo fmt
-        uses: actions-rs/cargo@v1
+        uses: actions-rs/cargo@v1.0.3
         with:
           command: fmt
 
       - name: Run cargo clippy
-        uses: actions-rs/cargo@v1
+        uses: actions-rs/cargo@v1.0.3
         with:
           command: clippy
           args: -- -A warnings
 
       - name: Run clippy on tests
-        uses: actions-rs/cargo@v1
+        uses: actions-rs/cargo@v1.0.3
         with:
           command: clippy
           args: --tests -- -A warnings

.github/workflows/publish.yaml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3.7.0
         with:
           token: ${{ secrets.GH_RUN_WORKFLOW_PAT }}
         # Install all dependencies
@@ -36,7 +36,7 @@ jobs:
           PACKAGEJSON_DIR:  'build_ts'
           TARGET-BRANCH: 'main'
       - name: Publish to npm
-        uses: JS-DevTools/npm-publish@v1
+        uses: JS-DevTools/npm-publish@v1.4.3
         with:
           access: public
           token: ${{ secrets.NPM_TOKEN }}