ci: pin GitHub Actions + pre-commit hooks (#2744)

* Update and pin GitHub Actions

* Pin pre-commit hooks too

* adjustments (don't pin official actions)

.github/workflows/update-dependencies.yml

@@ -28,18 +28,18 @@ jobs:
 
     # we use this step to grab a Github App auth token, so that PRs generated by this workflow
     # run the GHA tests.
-    - uses: actions/create-github-app-token@v2
+    - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
       id: generate-token
       if: github.ref == 'refs/heads/main' && github.repository == 'pypa/cibuildwheel'
       with:
         app-id: ${{ secrets.CIBUILDWHEEL_BOT_APP_ID }}
         private-key: ${{ secrets.CIBUILDWHEEL_BOT_APP_PRIVATE_KEY }}
 
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         persist-credentials: false
 
-    - uses: wntrblm/nox@2026.02.09
+    - uses: wntrblm/nox@5a277b752f6094150e25237d47c34168e2b7526e # 2026.02.09
 
     - name: "Run update: dependencies"
       run: nox --force-color -s update_constraints
@@ -50,7 +50,7 @@ jobs:
 
     - name: Create Pull Request
       if: github.ref == 'refs/heads/main' && github.repository == 'pypa/cibuildwheel'
-      uses: peter-evans/create-pull-request@v8
+      uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
       with:
         commit-message: Update dependencies
         title: '[Bot] Update dependencies'