Bump actions pins (#55)

* Bump actions/cache v5.0.1 → v5.0.3
* Bump actions/checkout v6.0.1 → v6.0.2
* Bump actions/download-artifact v7.0.0 → v8.0.1
* Bump actions/setup-node v6.1.0 → v6.3.0
* Bump actions/setup-python v6.1.0 → v6.2.0
* Bump actions/upload-artifact v6.0.0 → v7.0.0
* Bump astral-sh/ruff-action v3.5.1 → v3.6.1
* Bump oven-sh/setup-bun v2.0.2 → v2.2.0
* Bump pnpm/action-setup v4.2.0 → v5.0.0
* Bump zizmorcore/zizmor-action v0.3.0 → v0.5.2
* Bump actionlint v1.7.9 → v1.7.11
* Bump zizmor v1.19.0 → v1.23.1

.github/workflows/release.yml

@@ -13,7 +13,7 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0  # Needed for hatch-vcs versioning
           persist-credentials: false
@@ -21,7 +21,7 @@ jobs:
         with:
           deno-version: 3fbb1daddbc9333cddf0d8c0735811717dd70f7a  # v2.6.3
           cache: false
-      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548  # v6.1.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
           python-version: "3.10"
       - name: Install Python requirements
@@ -31,7 +31,7 @@ jobs:
         run: |
           python -m build
       - name: Upload Python artifacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: artifacts-py
           path: |
@@ -43,7 +43,7 @@ jobs:
           deno install --frozen
           deno task bundle
       - name: Upload JavaScript artifacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: artifacts-js
           path: |
@@ -58,7 +58,7 @@ jobs:
       id-token: write  # Needed for PyPI trusted publishing
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           path: dist
           name: artifacts-py
@@ -75,10 +75,10 @@ jobs:
       contents: write  # Needed by gh to publish release to Github
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           path: dist
           pattern: artifacts-*