[StepSecurity] ci: Harden GitHub Actions (#47)

Signed-off-by: StepSecurity Bot <[email protected]>

.github/workflows/release.yml

@@ -87,7 +87,7 @@ jobs:
         path: dist
         merge-multiple: true
     - name: Publish distribution 📦 to TestPyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@f7600683efdcb7656dec5b29656edb7bc586e597 # release/v1
       with:
         skip-existing: true
         print-hash: true
@@ -144,7 +144,7 @@ jobs:
         path: dist
         merge-multiple: true
     - name: Sign the dists with Sigstore
-      uses: sigstore/[email protected]
+      uses: sigstore/gh-action-sigstore-python@f514d46b907ebcd5bedc05145c03b69c1edd8b46 # v3.0.0
       with:
         inputs: >-
           ./dist/*.tar.gz

.github/workflows/semantic-release.yml

@@ -24,7 +24,7 @@ jobs:
         egress-policy: audit
 
     - name: Setup | Checkout Repository at workflow sha
-      uses: actions/checkout@v4
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       with:
         fetch-depth: 0
         ref: ${{ github.sha }}
@@ -36,14 +36,14 @@ jobs:
     - name: Action | Semantic Version Release
       id: release
       # Adjust tag with desired version if applicable.
-      uses: python-semantic-release/[email protected]
+      uses: python-semantic-release/python-semantic-release@fd8c509df1f16daf3f71a9a6fac49247017017b2 # v9.9.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         git_committer_name: "github-actions"
         git_committer_email: "[email protected]"
 
     - name: Publish | Upload to GitHub Release Assets
-      uses: python-semantic-release/[email protected]
+      uses: python-semantic-release/publish-action@66f674d05b321fac03f61cb30f613b7ed2773789 # v9.9.0
       if: steps.release.outputs.released == 'true'
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}