chore(security): pin down actions to commit SHA

Signed-off-by: Keshav Priyadarshi <git@keshav.space>

Author: keshav-space

.github/workflows/sync.yml

@@ -10,16 +10,16 @@ permissions:
 
 jobs:
   scheduled:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.10'
+          python-version: '3.11'
 
       - name: Install required packages
         run: pip install requests==2.32.5 aboutcode.pipeline==0.2.1
@@ -34,4 +34,4 @@ jobs:
           git add -A
           timestamp=$(date -u)
           git commit -m "$(echo -e "Sync NuGet catalog: $timestamp\n\nSigned-off-by: AboutCode Automation <automation@aboutcode.org>")" || exit 0
-          git push
+          git push