ci: pin github action to specific hash (#1799)

.github/workflows/bundle-desktop-windows.yml

@@ -26,11 +26,11 @@ jobs:
     steps:
       # 1) Check out source
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
 
       # 2) Set up Rust
       - name: Set up Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@38b70195107dddab2c7bbd522bcf763bac00963b
         # If you need a specific version, you could do:
         # or uses: actions/setup-rust@v1
         # with:
@@ -38,13 +38,13 @@ jobs:
 
       # 3) Set up Node.js
       - name: Set up Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # pin@v3
         with:
           node-version: 16
 
       # 4) Cache dependencies (optional, can add more paths if needed)
       - name: Cache node_modules
-        uses: actions/cache@v3
+        uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # pin@v3
         with:
           path: |
             node_modules
@@ -151,7 +151,7 @@ jobs:
 
       # 11) Upload the final Windows build
       - name: Upload Windows build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # pin@v4
         with:
           name: desktop-windows-dist
           path: ui/desktop/out/Goose-win32-x64/