sha pin all github actions for package workflow

.github/workflows/package.yaml

@@ -12,14 +12,14 @@ jobs:
       matrix:
         os: [windows-2022, ubuntu-22.04, ubuntu-22.04-arm, macos-15-intel, macos-14]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           submodules: recursive
       - name: Clear Java tool-cache for reproducibility
         shell: bash
         run: rm -rf "$RUNNER_TOOL_CACHE"/Java_*
       - name: Set up JDK 25.0.2
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
         with:
           distribution: 'temurin'
           java-version: '25.0.2'
@@ -29,7 +29,7 @@ jobs:
         run: ./gradlew jpackage
       - name: Codesign, package and notarize macOS distribution
         if: ${{ runner.os == 'macOS' }}
-        uses: sparrowwallet/github-actions/codesign-macos@v1
+        uses: sparrowwallet/github-actions/codesign-macos@6eeb7bf9b882cf89ff96b77f99bcf487b9d33992 # v1
         with:
           app-name: Sparrow
           certificate: ${{ secrets.MACOS_CERTIFICATE }}
@@ -47,7 +47,7 @@ jobs:
         if: ${{ runner.os == 'Linux' }}
         run: ./repackage.sh
       - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: Sparrow Build - ${{ runner.os }} ${{ runner.arch }}
           path: |
@@ -65,7 +65,7 @@ jobs:
         run: ./repackage.sh
       - name: Upload Headless Artifact
         if: ${{ runner.os == 'Linux' }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: Sparrow Build - ${{ runner.os }} ${{ runner.arch }} Headless
           path: |