chore(deps): pin dependencies (#292)

[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Type | Update |
|---|---|---|---|
| [actions/checkout](https://togithub.com/actions/checkout) | [ ->
`692973e`](https://togithub.com/actions/checkout/compare/...692973e) |
action | pinDigest |
|
[addnab/docker-run-action](https://togithub.com/addnab/docker-run-action)
| [ ->
`4f65fab`](https://togithub.com/addnab/docker-run-action/compare/...4f65fab)
| action | pinDigest |
|
[amannn/action-semantic-pull-request](https://togithub.com/amannn/action-semantic-pull-request)
| [ ->
`0723387`](https://togithub.com/amannn/action-semantic-pull-request/compare/...0723387)
| action | pinDigest |
|
[aquaproj/update-checksum-workflow](https://togithub.com/aquaproj/update-checksum-workflow)
| [ ->
`75c72cd`](https://togithub.com/aquaproj/update-checksum-workflow/compare/...75c72cd)
| action | pinDigest |
|
[google-github-actions/release-please-action](https://togithub.com/google-github-actions/release-please-action)
| [ ->
`e4dc86b`](https://togithub.com/google-github-actions/release-please-action/compare/...e4dc86b)
| action | pinDigest |
| [trunk-io/trunk-action](https://togithub.com/trunk-io/trunk-action) |
[ ->
`86b68ff`](https://togithub.com/trunk-io/trunk-action/compare/...86b68ff)
| action | pinDigest |

---

### Configuration

📅 **Schedule**: Branch creation - "after 4pm on thursday" in timezone
America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View the
[repository job log](https://developer.mend.io/github/scottames/dots).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40NDAuNyIsInVwZGF0ZWRJblZlciI6IjM3LjQ0MC43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/pr_aqua_update_checksum.yaml

@@ -7,7 +7,7 @@ on:
       - aqua/aqua-checksums.json
 jobs:
   update-aqua-checksums:
-    uses: aquaproj/update-checksum-workflow/.github/workflows/[email protected] # renovate: depName=aquaproj/update-checksum-workflow
+    uses: aquaproj/update-checksum-workflow/.github/workflows/update-checksum.yaml@75c72cdc372a43dd1b1ad0458748f5d6bfeac7b9 # v1.0.1 # renovate: depName=aquaproj/update-checksum-workflow
     permissions:
       contents: read
     with:

.github/workflows/pr_chezmoi_init.yaml

@@ -16,14 +16,14 @@ jobs:
       checks: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       - name: Extract branch name
         shell: bash
         run: |
           echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT
         id: extract_branch
       - name: Run chezmoi init in container
-        uses: addnab/docker-run-action@v3
+        uses: addnab/docker-run-action@4f65fabd2431ebc8d299f8e5a018d79a769ae185 # v3
         with:
           # https://github.com/scottames/boxes
           image: ghcr.io/scottames/fedora-toolbox:latest

.github/workflows/pr_semantic.yml

@@ -14,6 +14,6 @@ jobs:
     permissions:
       checks: write
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pr_trunkio.yaml

@@ -13,6 +13,6 @@ jobs:
       checks: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       - name: Trunk
-        uses: trunk-io/trunk-action@v1
+        uses: trunk-io/trunk-action@86b68ffae610a05105e90b1f52ad8c549ef482c2 # v1

.github/workflows/release_please.yml

@@ -12,7 +12,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: google-github-actions/release-please-action@v4
+      - uses: google-github-actions/release-please-action@e4dc86ba9405554aeba3c6bb2d169500e7d3b4ee # v4
         with:
           release-type: go
           package-name: dots

.github/workflows/trunk_upgrades.yaml

@@ -14,9 +14,9 @@ jobs:
       pull-requests: write # For trunk to create PRs
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       - name: Trunk Upgrade
-        uses: trunk-io/trunk-action/upgrade@v1
+        uses: trunk-io/trunk-action/upgrade@86b68ffae610a05105e90b1f52ad8c549ef482c2 # v1
         with:
           prefix: "chore: "
           lowercase-title: true