ci: pin GitHub action versions to full length SHAs

Author: josephperrott

.github/workflows/publish.yaml

@@ -21,7 +21,7 @@ on:
         type: string
 jobs:
   publish:
-    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v0.2.1
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@d07b5b1e1a6364b402e33146f5ae6984a9363162 # v0.2.1
     with:
       tag_name: ${{ inputs.tag_name }}
       # GitHub repository which is a fork of the upstream where the Pull Request will be opened.

.github/workflows/release.yaml

@@ -20,7 +20,7 @@ permissions:
   contents: write
 jobs:
   release:
-    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.2
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@9ed8d86404ac3214f80cfb02e49f44a1b28b17b0 # v7.2.2
     with:
       release_files: rules_angular-*.tar.gz
       prerelease: false