Using hashes for all actions (#81)

* Use full commit SHAs for all GitHub actions as described in SPEC 8.

.github/workflows/ci.yml

@@ -21,10 +21,10 @@ jobs:
     if: github.repository == 'scientific-python/upload-nightly-action'
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29  # v4.1.6
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d  # v5.1.0
         with:
           python-version: '3.x'
 
@@ -97,7 +97,7 @@ jobs:
 
     steps:
       - name: Install micromamba and anaconda-client
-        uses: mamba-org/setup-micromamba@v1
+        uses: mamba-org/setup-micromamba@f8b8a1e23a26f60a44c853292711bacfd3eac822  # v1.9.0
         with:
           environment-name: remove-wheels
           create-args: >-

.github/workflows/keep-alive.yml

@@ -18,7 +18,7 @@ jobs:
       group: ${{ github.workflow }}-${{ github.ref }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29  # v4.1.6
 
     - name: Create a minimal payload
       run: |

.github/workflows/remove-wheels.yml

@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Install micromamba and anaconda-client
-        uses: mamba-org/setup-micromamba@v1
+        uses: mamba-org/setup-micromamba@f8b8a1e23a26f60a44c853292711bacfd3eac822  # v1.9.0
         with:
           environment-name: remove-wheels
           create-args: >-