ci: pin dependencies (nodejs#2957)

Author: UlisesGascon

.github/workflows/nodejs.yml

@@ -100,7 +100,7 @@ jobs:
 
       - name: Coverage Report
         if: matrix.runs-on == 'ubuntu-latest' && matrix.node-version == 20
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@54bcd8715eee62d40e33596ef5e8f0f48dbbccab # v4.1.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}