Update GitHub Actions

Author: renovate[bot]

.github/workflows/add-to-project.yaml

@@ -17,5 +17,5 @@ on:
 jobs:
   call-workflow-add-to-project:
     name: Call workflow to add issue to project
-    uses: bufbuild/base-workflows/.github/workflows/add-to-project.yaml@main
+    uses: bufbuild/base-workflows/.github/workflows/add-to-project.yaml@7be6b0f6700ab0c62145c2b4ca2efd103bfc4895 # main
     secrets: inherit

.github/workflows/ci.yaml

@@ -24,7 +24,7 @@ jobs:
       UV_RESOLUTION: "${{ matrix.resolution }}"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: stable
           # We use this to install `buf`, and the `buf` version is controlled by the Makefile.

.github/workflows/emergency-review-bypass.yaml

@@ -9,5 +9,5 @@ jobs:
   approve:
     name: Approve
     if: github.event.label.name == 'Emergency Bypass Review'
-    uses: bufbuild/base-workflows/.github/workflows/emergency-review-bypass.yaml@main
+    uses: bufbuild/base-workflows/.github/workflows/emergency-review-bypass.yaml@7be6b0f6700ab0c62145c2b4ca2efd103bfc4895 # main
     secrets: inherit

.github/workflows/notify-approval-bypass.yaml

@@ -10,5 +10,5 @@ permissions:
 jobs:
   notify:
     name: Notify
-    uses: bufbuild/base-workflows/.github/workflows/notify-approval-bypass.yaml@main
+    uses: bufbuild/base-workflows/.github/workflows/notify-approval-bypass.yaml@7be6b0f6700ab0c62145c2b4ca2efd103bfc4895 # main
     secrets: inherit

.github/workflows/pr-title.yaml

@@ -15,4 +15,4 @@ on:
       - synchronize
 jobs:
   lint:
-    uses: bufbuild/base-workflows/.github/workflows/pr-title.yaml@main
+    uses: bufbuild/base-workflows/.github/workflows/pr-title.yaml@7be6b0f6700ab0c62145c2b4ca2efd103bfc4895 # main

.github/workflows/release.yaml

@@ -50,4 +50,4 @@ jobs:
           path: dist
 
       - name: Publish on PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1