Pin dependencies

docker-ci-image-workflows/build-and-promote-ma/action.yml

@@ -51,7 +51,7 @@ runs:
   using: 'composite'
   steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
     - name: Set image name
       id: image
@@ -64,10 +64,10 @@ runs:
         fi
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
     - name: Log in to Container Registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
       with:
         registry: ${{ inputs.registry }}
         username: ${{ inputs.registry_username || github.actor }}
@@ -136,7 +136,7 @@ runs:
 
     - name: Extract metadata
       id: meta
-      uses: docker/metadata-action@v5
+      uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
       with:
         images: ${{ inputs.registry }}/${{ steps.image.outputs.name }}
         tags: |
@@ -146,7 +146,7 @@ runs:
 
     - name: Build and push MA image
       id: build
-      uses: docker/build-push-action@v5
+      uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
       with:
         context: ${{ inputs.docker_context }}
         file: ${{ inputs.dockerfile_path }}
@@ -186,7 +186,7 @@ runs:
         cat main-image-manifest.json
 
     - name: Create GitHub Release
-      uses: actions/github-script@v7
+      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
       with:
         script: |
           const fs = require('fs');
@@ -219,7 +219,7 @@ runs:
           }
 
     - name: Upload manifest as artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: main-builded-manifest.zip
         path: main-image-manifest.json

docker-ci-image-workflows/build-pr/action.yml

@@ -37,7 +37,7 @@ runs:
   using: 'composite'
   steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
     - name: Set image name
       id: image
@@ -50,10 +50,10 @@ runs:
         fi
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
     - name: Log in to Container Registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
       with:
         registry: ${{ inputs.registry }}
         username: ${{ inputs.registry_username || github.actor }}
@@ -73,15 +73,15 @@ runs:
 
     - name: Extract metadata
       id: meta
-      uses: docker/metadata-action@v5
+      uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
       with:
         images: ${{ inputs.registry }}/${{ steps.image.outputs.name }}
         tags: |
           type=ref,event=pr,prefix=pr-
           type=sha,prefix=pr-{{branch}}-
 
     - name: Build and push PR image
-      uses: docker/build-push-action@v5
+      uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
       with:
         context: ${{ inputs.docker_context }}
         file: ${{ inputs.dockerfile_path }}
@@ -94,7 +94,7 @@ runs:
         cache-to: type=gha,mode=max
 
     - name: Comment PR with image tags
-      uses: actions/github-script@v7
+      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
       with:
         script: |
           const tags = `${{ steps.meta.outputs.tags }}`.split('\n');

helm-bump/action.yml

@@ -49,7 +49,7 @@ runs:
 
     - name: Bump Chart Version
       id: bump_chart_version
-      uses: pagopa/github-actions-template/bump-semver@main
+      uses: pagopa/github-actions-template/bump-semver@713f5abd8f8ee210e5f6a4243ae52eb7c1b3b5ab # main
       with:
         semver: ${{ (inputs.beta == 'true' && 'patch') || 'minor' }}
         current_version: ${{ env.chart_version }}

maven-release/action.yml

@@ -68,7 +68,7 @@ runs:
 
     - name: Update Semantic Version
       id: semver
-      uses: pagopa/github-actions-template/maven-semver@main
+      uses: pagopa/github-actions-template/maven-semver@713f5abd8f8ee210e5f6a4243ae52eb7c1b3b5ab # main
       with:
         semver: ${{inputs.semver}}
         beta: ${{inputs.beta}}

maven-semver/action.yml

@@ -99,7 +99,7 @@ runs:
 
     - name: Helm Bump
       if: ${{ inputs.semver != 'skip' }}
-      uses: pagopa/github-actions-template/helm-bump@main
+      uses: pagopa/github-actions-template/helm-bump@713f5abd8f8ee210e5f6a4243ae52eb7c1b3b5ab # main
       with:
         version: ${{ steps.get_app_version.outputs.version }}
         beta: ${{ inputs.beta }}

node-release/action.yml

@@ -85,7 +85,7 @@ runs:
 
     - name: Bump Package Version
       id: bump
-      uses: pagopa/github-actions-template/bump-semver@main
+      uses: pagopa/github-actions-template/bump-semver@713f5abd8f8ee210e5f6a4243ae52eb7c1b3b5ab # main
       with:
         semver: ${{ inputs.semver  }}
         current_version: ${{ env.version }}
@@ -99,7 +99,7 @@ runs:
 
     - name: Helm Bump
       if: ${{ inputs.semver != 'skip' }}
-      uses: pagopa/github-actions-template/helm-bump@main
+      uses: pagopa/github-actions-template/helm-bump@713f5abd8f8ee210e5f6a4243ae52eb7c1b3b5ab # main
       with:
         version: ${{ steps.semver.outputs.new_version }}
         beta: ${{ inputs.beta }}

payments-flow-release/action.yml

@@ -48,7 +48,7 @@ runs:
 
     - name: 🚀 Release
       id: release
-      uses: pagopa/eng-github-actions-iac-template/global/release-action@main
+      uses: pagopa/eng-github-actions-iac-template/global/release-action@fa09a2b6def96e72c1b529ade6bd031c18562978 # main
       with:
         github_token: ${{ steps.set_token.outputs.GIT_AUTH_TOKEN }}
         tag_format: ${{ steps.set-tag-format.outputs.TAG_FORMAT }}

sbt-release/action.yml

@@ -64,7 +64,7 @@ runs:
 
     - name: Update Semantic Version
       id: semver
-      uses: pagopa/github-actions-template/sbt-semver@main
+      uses: pagopa/github-actions-template/sbt-semver@713f5abd8f8ee210e5f6a4243ae52eb7c1b3b5ab # main
       with:
         semver: ${{inputs.semver}}
         beta: ${{inputs.beta}}

sbt-semver/action.yml

@@ -131,7 +131,7 @@ runs:
 
     - name: Helm Bump
       if: ${{ inputs.semver != 'skip' }}
-      uses: pagopa/github-actions-template/helm-bump@main
+      uses: pagopa/github-actions-template/helm-bump@713f5abd8f8ee210e5f6a4243ae52eb7c1b3b5ab # main
       with:
         version: ${{ steps.get_app_version.outputs.version }}
         beta: ${{ inputs.beta }}