Pin GitHub Actions to commit hashes in workflow files

Pin actions/checkout, actions/setup-python, actions/download-artifact,
and actions/upload-artifact to their commit hashes in
reusable-check-html-ids.yml and reusable-docs.yml to satisfy the
zizmor unpinned-uses audit.

Author: WYSIATI

.github/workflows/reusable-check-html-ids.yml

@@ -16,12 +16,12 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: 'Check out base commit'
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           ref: ${{ github.event.pull_request.base.sha }}
       - name: 'Set up Python'
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3'
           cache: 'pip'
@@ -31,7 +31,7 @@ jobs:
       - name: 'Build HTML documentation'
         run: make -C Doc/ SPHINXOPTS="--quiet" html
       - name: 'Check out PR head tools'
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -46,7 +46,7 @@ jobs:
       - name: 'Collect HTML IDs'
         run: python Doc/tools/check-html-ids.py collect Doc/build/html -o /tmp/html-ids-base.json.gz
       - name: 'Download PR head HTML IDs'
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: html-ids-head.json.gz
           path: /tmp

.github/workflows/reusable-docs.yml

@@ -80,7 +80,7 @@ jobs:
       run: python Doc/tools/check-html-ids.py collect Doc/build/html -o Doc/build/html-ids-head.json.gz
     - name: 'Upload HTML IDs'
       if: github.event_name == 'pull_request'
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
       with:
         name: html-ids-head
         path: Doc/build/html-ids-head.json.gz