Pin commit hashes

Author: onethumb

.github/workflows/windows-release.yaml

@@ -56,7 +56,7 @@ jobs:
       matrix: ${{ steps.extension-matrix.outputs.matrix }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4 # not pinning to commit since this is a GitHub action, which we trust
         with:
           ref: ${{ needs.check-trigger.outputs.tag_name }}
 
@@ -70,7 +70,7 @@ jobs:
       
       - name: Generate extension build matrix
         id: extension-matrix
-        uses: php/php-windows-builder/extension-matrix@v1
+        uses: php/php-windows-builder/extension-matrix@473a9676298287032e657ee9658002a893df4eb9 # pinned to 1.2.0 commit hash
         with:
           arch-list: 'x64'
           php-version-list: "8.1, 8.2, 8.3, 8.4" # reading from composer.json doesn't seem to work?
@@ -83,7 +83,7 @@ jobs:
       matrix: ${{ fromJson(needs.get-extension-matrix.outputs.matrix) }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4 # not pinning to commit since this is a GitHub action, which we trust
         with:
           ref: ${{ needs.check-trigger.outputs.tag_name }}
 
@@ -218,7 +218,7 @@ jobs:
           echo "All required library files verified successfully"
       
       - name: Build extension with php-windows-builder
-        uses: php/php-windows-builder/extension@v1
+        uses: php/php-windows-builder/extension@473a9676298287032e657ee9658002a893df4eb9 # pinned to 1.2.0 commit hash
         with:
           php-version: ${{ matrix.php-version }}
           arch: ${{ matrix.arch }}
@@ -232,7 +232,7 @@ jobs:
     if: needs.check-trigger.outputs.should_run == 'true'
     steps:
       - name: Create draft release with artifacts
-        uses: php/php-windows-builder/release@v1
+        uses: php/php-windows-builder/release@473a9676298287032e657ee9658002a893df4eb9 # pinned to 1.2.0 commit hash
         with:
           release: ${{ needs.check-trigger.outputs.tag_name }}
           token: ${{ secrets.GITHUB_TOKEN }}