chore: pin publish workflow actions by SHA

.github/workflows/publish.yml

@@ -35,7 +35,7 @@ jobs:
     if: github.event_name == 'workflow_dispatch' && inputs.create_tag
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Create pre-release tag
         run: |
           git fetch --tags
@@ -107,8 +107,8 @@ jobs:
             exit 1
           fi
           echo "::notice::Environment '${ENV_NAME}' is protected with prevent_self_review. OK."
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v6
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
         with:
           version: "0.12.9"
           enable-cache: true