Pin dependencies

.github/workflows/pre-commit-check.yaml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3
       with:
         fetch-depth: 0
 
@@ -28,14 +28,14 @@ jobs:
 
     # run only if changed files were detected
     - name: Run against changes
-      uses: pre-commit/action@v2.0.3
+      uses: pre-commit/action@9b88afc9cd57fd75b655d5c71bd38146d07135fe # tag=v2.0.3
       if: steps.filter.outputs.addedOrModified == 'true'
       with:
         extra_args: --files ${{ steps.filter.outputs.addedOrModified_files }}
 
     # run if no changed files were detected (e.g. workflow_dispatch on master branch)
     - name: Run against all files
-      uses: pre-commit/action@v2.0.3
+      uses: pre-commit/action@9b88afc9cd57fd75b655d5c71bd38146d07135fe # tag=v2.0.3
       if: steps.filter.outputs.addedOrModified != 'true'
       with:
         extra_args: --all-files