chore: pin docker/metadata-action and docker build actions to full SHA

Author: hhvrc

.github/actions/build-app/action.yml

@@ -23,7 +23,7 @@ runs:
   steps:
     - name: Extract metadata (tags, labels) for Docker
       id: meta
-      uses: docker/metadata-action@v5
+      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
       with:
         images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ inputs.image }}
         flavor: |
@@ -32,7 +32,7 @@ runs:
           type=raw,value=${{ inputs.tag-prefix }}-${{ github.run_number }}-a${{ github.run_attempt }}
 
     - name: Build and push
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
       with:
         context: .
         file: ${{ inputs.dockerfile }}

.github/actions/promote-image/action.yml

@@ -17,7 +17,7 @@ runs:
 
     - name: Extract metadata (tags, labels) for Promotion
       id: remeta
-      uses: docker/metadata-action@v5
+      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
       with:
         images: ${{ inputs.image }}
         flavor: |