Update action versions in build workflow

.github/workflows/build.yml

@@ -34,19 +34,20 @@ jobs:
           echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
           echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
 
+      # These stage versions are pinned by https://github.com/renovatebot/renovate
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
 
       - name: Mount BTRFS for podman storage
         id: container-storage-action
-        uses: ublue-os/container-storage-action@main
+        uses: ublue-os/container-storage-action@911baca08baf30c8654933e9e9723cb399892140 # main
         continue-on-error: true 
         with:
           target-dir: /var/lib/containers
           mount-opts: compress-force=zstd:2
 
       - name: Image Metadata
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v5
         id: metadata
         with:
           tags: |
@@ -69,7 +70,7 @@ jobs:
           sep-annotations: " "
 
       - name: Cache buildah layers
-        uses: actions/cache@v5
+        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         with:
           path: |
             /var/lib/containers/storage/overlay
@@ -81,7 +82,7 @@ jobs:
 
       - name: Build Image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2
         with:
           containerfiles: |
             ./Containerfile
@@ -106,7 +107,7 @@ jobs:
             --output=oci-archive:./chunkah-out/image.ociarchive
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v3
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         with:
           registry: ghcr.io
@@ -135,7 +136,7 @@ jobs:
           echo "REGISTRY_DIGEST=$FINAL_REGISTRY_DIGEST" >> $GITHUB_ENV
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v4
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
       
       - name: Sign container image