Pin dependencies

Author: renovate[bot]

.github/workflows/add-to-project.yaml

@@ -17,5 +17,5 @@ on:
 jobs:
   call-workflow-add-to-project:
     name: Call workflow to add issue to project
-    uses: bufbuild/base-workflows/.github/workflows/add-to-project.yaml@main
+    uses: bufbuild/base-workflows/.github/workflows/add-to-project.yaml@7be6b0f6700ab0c62145c2b4ca2efd103bfc4895 # main
     secrets: inherit

.github/workflows/emergency-review-bypass.yaml

@@ -9,5 +9,5 @@ jobs:
   approve:
     name: Approve
     if: github.event.label.name == 'Emergency Bypass Review'
-    uses: bufbuild/base-workflows/.github/workflows/emergency-review-bypass.yaml@main
+    uses: bufbuild/base-workflows/.github/workflows/emergency-review-bypass.yaml@7be6b0f6700ab0c62145c2b4ca2efd103bfc4895 # main
     secrets: inherit

.github/workflows/notify-approval-bypass.yaml

@@ -10,5 +10,5 @@ permissions:
 jobs:
   notify:
     name: Notify
-    uses: bufbuild/base-workflows/.github/workflows/notify-approval-bypass.yaml@main
+    uses: bufbuild/base-workflows/.github/workflows/notify-approval-bypass.yaml@7be6b0f6700ab0c62145c2b4ca2efd103bfc4895 # main
     secrets: inherit

.github/workflows/pr-title.yaml

@@ -15,4 +15,4 @@ on:
       - synchronize
 jobs:
   lint:
-    uses: bufbuild/base-workflows/.github/workflows/pr-title.yaml@main
+    uses: bufbuild/base-workflows/.github/workflows/pr-title.yaml@7be6b0f6700ab0c62145c2b4ca2efd103bfc4895 # main

.github/workflows/release.yaml

@@ -50,4 +50,4 @@ jobs:
           path: dist
 
       - name: Publish on PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1