pin used actions

plus some reordering and harmonization across files

.github/workflows/docker-release.yml

@@ -56,7 +56,7 @@ jobs:
         include:
           - label: x86
             platform: linux/amd64
-            runner: ubuntu-latest    # https://github.com/actions/runner-images
+            runner: ubuntu-latest    # https://github.com/actions/runner-images#available-images
 
           - label: arm
             platform: linux/arm64
@@ -67,17 +67,17 @@ jobs:
 
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ case(github.event_name == 'workflow_dispatch', format('refs/tags/{0}', inputs.tag), '') }}
 
       - name: "Set up Docker buildx"
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: "Login to GitHub Container Registry (GHCR)"
         if: (github.event_name == 'release' && github.event.release.prerelease == false) || github.event_name == 'workflow_dispatch'
         id: login
-        uses: docker/login-action@v4
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -92,7 +92,7 @@ jobs:
       # cache held. The final runtime stage is the part that still pays off.
       - name: "Build image"
         if: steps.login.outcome != 'success'
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           cache-from: type=gha,scope=${{ env.CACHE_SCOPE }}
           cache-to: ${{ case(github.ref == 'refs/heads/master', format('type=gha,mode=min,scope={0}', env.CACHE_SCOPE), '') }}
@@ -104,7 +104,7 @@ jobs:
       - name: "Build image and push by digest"
         if: steps.login.outcome == 'success'
         id: build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           cache-from: type=gha,scope=${{ env.CACHE_SCOPE }}
           cache-to: type=gha,mode=min,scope=${{ env.CACHE_SCOPE }}
@@ -115,7 +115,7 @@ jobs:
             org.opencontainers.image.url=${{ env.OCI_URL }}
           outputs: type=image,name=${{ env.GHCR_IMAGE }},name-canonical=true,push=true,push-by-digest=true
           platforms: ${{ matrix.platform }}
-          provenance: mode=max    # Do not pass secrets as build arguments with this option
+          provenance: mode=max    # do not pass secrets as build arguments with this option
           sbom: true
 
       - name: "Export digest"
@@ -128,7 +128,7 @@ jobs:
 
       - name: "Upload digest"
         if: steps.login.outcome == 'success'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           if-no-files-found: error
           name: digest-${{ matrix.label }}
@@ -145,14 +145,14 @@ jobs:
 
     steps:
       - name: "Download digests"
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: ${{ runner.temp }}/digests
           pattern: digest-*
           merge-multiple: true
 
       - name: "Login to GitHub Container Registry (GHCR)"
-        uses: docker/login-action@v4
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -160,7 +160,7 @@ jobs:
 
       - name: "Docker metadata"
         id: metadata
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ env.GHCR_IMAGE }}
           flavor: |