Pin dependencies

Author: renovate-bot

.github/workflows/check-untracked-repos.yml

@@ -10,7 +10,7 @@ jobs:
   check-untracked-repos:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
 

.github/workflows/main.yml

@@ -119,7 +119,7 @@ jobs:
       # Upload the pages only if the sync succeeded, to always keep the
       # most up-to-date state in the web endpoint.
       - name: Deploy to GitHub Pages
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
 
   # Summary job for the merge queue.
   # ALL THE PREVIOUS JOBS NEED TO BE ADDED TO THE `needs` SECTION OF THIS JOB!