Pinning CLA to specfic commit hasj

.github/workflows/cla.yml

@@ -12,7 +12,7 @@ jobs:
       - name: "CLA Assistant"
         if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
         # Beta Release
-        uses: cla-assistant/github-action@v2.1.3-beta
+        uses: cla-assistant/github-action@f41946747f85d28e9a738f4f38dbcc74b69c7e0e
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # the below token should have repo scope and must be manually added by you in the repository's secret

.github/workflows/pypi_publish.yml

@@ -15,17 +15,17 @@ jobs:
     # Define job steps
     steps:
     - name: Set up Python 3.10.2
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f
       with:
-        python-version: 3.10.2
+        python-version: "3.10.2"
 
     - name: Check-out repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
       with:
         fetch-depth: 0
 
     - name: Install poetry
-      uses: snok/install-poetry@v1
+      uses: snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a
 
     # Installing dependencies via poetry:
     - name: Install packages
@@ -40,7 +40,7 @@ jobs:
 
     # Publishing to TestPyPI:
     - name: Publish to TestPyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0
       with:
         user: __token__
         password: ${{ secrets.TEST_PYPI_API_TOKEN }}
@@ -63,7 +63,7 @@ jobs:
 
     # Upload to PyPI only if everything else is correct:
     - name: Publish to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0
       with:
         user: __token__
         password: ${{ secrets.PYPI_API_TOKEN }}