ci: pin non-gh, non-hynek, non-pypa uses

Author: hynek

.github/workflows/ci.yml

@@ -228,6 +228,7 @@ jobs:
 
     steps:
       - name: Decide whether the needed jobs succeeded or failed
-        uses: re-actors/alls-green@release/v1
+        # v1.2.2
+        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe
         with:
           jobs: ${{ toJSON(needs) }}

.github/workflows/codspeed.yml

@@ -39,7 +39,8 @@ jobs:
       - uses: hynek/setup-cached-uv@v2
 
       - name: Run CodSpeed benchmarks
-        uses: CodSpeedHQ/action@v3
+        # v3.5.0
+        uses: CodSpeedHQ/action@0010eb0ca6e89b80c88e8edaaa07cfe5f3e6664d
         with:
           token: ${{ secrets.CODSPEED_TOKEN }}
           run: uvx --with tox-uv tox run -e codspeed

zizmor.yml

@@ -0,0 +1,9 @@
+---
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "actions/*": ref-pin
+        "github/*": ref-pin
+        "hynek/*": ref-pin
+        "pypa/*": ref-pin