chore(gha): pin dependencies (#9)

| datasource  | package                             | from | to   |
| ----------- | ----------------------------------- | ---- | ---- |
| github-tags | dockerbakery/github-metadata-action | v3   | v3.0 |

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/workflows/ci.yaml

@@ -24,9 +24,9 @@ jobs:
     outputs:
       matrix: ${{ steps.generate.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - id: generate
-        uses: docker/bake-action/subaction/matrix@v6
+        uses: docker/bake-action/subaction/matrix@3acf805d94d93a86cce4ca44798a76464a75b88c # v6
 
   build:
     runs-on: ubuntu-latest
@@ -41,27 +41,27 @@ jobs:
       packages: write
     steps:
       - name: set up qemu
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
 
       - name: set up docker buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
 
       - name: generate docker metadata
         id: docker-meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
 
       - name: generate github metadata
         id: github-meta
-        uses: dockerbakery/github-metadata-action@v3
+        uses: dockerbakery/github-metadata-action@eb086bf6c4b697df69a9135a2250e1a2214f0cc0 # v3.0
 
       - name: login to docker hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3
         with:
           username: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
           password: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
 
       - name: build and push
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@3acf805d94d93a86cce4ca44798a76464a75b88c # v6
         with:
           targets: ${{ matrix.target }}
           push: ${{ github.event_name != 'pull_request' }}