ci: pin github actions (#199)

.github/workflows/test.yaml

@@ -22,7 +22,7 @@ jobs:
           - windows-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Run the action
         uses: ./
@@ -51,7 +51,7 @@ jobs:
           - windows-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Run the action
         uses: ./
@@ -74,8 +74,8 @@ jobs:
       fail-fast: false
       matrix:
         os:
+          # macos is excluded from this test because node 12 is no longer available on this platform
           - ubuntu-latest
-          - macos-latest
           - windows-latest
 
         standalone:
@@ -83,7 +83,7 @@ jobs:
           - false
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Run the action
         uses: ./
@@ -92,7 +92,7 @@ jobs:
           standalone: ${{ matrix.standalone }}
 
       - name: install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           # pnpm@7.0.0 is not compatible with Node.js 12
           node-version: 12.22.12
@@ -160,7 +160,7 @@ jobs:
                 - yarn
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Run the action
         uses: ./

src/inputs/run-install.ts

@@ -1,5 +1,5 @@
 import { getInput, error } from '@actions/core'
-import * as yaml from 'yaml'
+import { parse as parseYaml } from 'yaml'
 import { z, ZodError } from 'zod'
 
 const RunInstallSchema = z.object({
@@ -20,7 +20,7 @@ export type RunInstall = z.infer<typeof RunInstallSchema>
 
 export function parseRunInstall(inputName: string): RunInstall[] {
   const input = getInput(inputName, { required: true })
-  const parsedInput: unknown = yaml.parse(input)
+  const parsedInput: unknown = parseYaml(input)
 
   try {
     const result: RunInstallInput = RunInstallInputSchema.parse(parsedInput)

src/install-pnpm/run.ts

@@ -6,7 +6,7 @@ import path from 'path'
 import { execPath } from 'process'
 import util from 'util'
 import { Inputs } from '../inputs'
-import YAML from 'yaml'
+import { parse as parseYaml } from 'yaml'
 
 export async function runSelfInstaller(inputs: Inputs): Promise<number> {
   const { version, dest, packageJsonFile, standalone } = inputs
@@ -63,7 +63,7 @@ async function readTarget(opts: {
     try {
       const content = readFileSync(path.join(GITHUB_WORKSPACE, packageJsonFile), 'utf8');
       ({ packageManager } = packageJsonFile.endsWith(".yaml")
-        ? YAML.parse(content, { merge: true })
+        ? parseYaml(content, { merge: true })
         : JSON.parse(content)
       )
     } catch (error: unknown) {