chore(deps): pin dependencies

.github/workflows/propagate-changes.yml

@@ -18,7 +18,7 @@ jobs:
       github.event.pusher != null\n    "
     steps:
       - name: Set up Node (for github-script)
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '18'
 
@@ -33,7 +33,7 @@ jobs:
           fi
 
       - name: Create or update Pull Request
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const source = process.env.SOURCE_BRANCH || process.env.GITHUB_REF.replace('refs/heads/','');