ci: pin 3rd-party action dependencies by commit hashes

Signed-off-by: Daniel Hast <hast.daniel@protonmail.com>

diff --git a/.github/workflows/check_cirrus_cron.yml b/.github/workflows/check_cirrus_cron.yml
index 60ee8d1c353e9034b4f211d334febefa463dc5ca..bd69c470842b6b8df37d6cc781bcf3887c48e65d 100644 (file)
--- a/.github/workflows/check_cirrus_cron.yml
+++ b/.github/workflows/check_cirrus_cron.yml
@@ -61,7 +61,7 @@ jobs:
             - if: steps.cron.outputs.failures > 0
               name: Send failure notification e-mail
               # Ref: https://github.com/dawidd6/action-send-mail
-              uses: dawidd6/action-send-mail@v3.12.0
+              uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
               with:
                 server_address: ${{secrets.ACTION_MAIL_SERVER}}
                 server_port: 465
@@ -80,7 +80,7 @@ jobs:
 
             - if: failure()
               name: Send error notification e-mail
-              uses: dawidd6/action-send-mail@v3.12.0
+              uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
               with:
                 server_address: ${{secrets.ACTION_MAIL_SERVER}}
                 server_port: 465

diff --git a/.github/workflows/issue_pr_lock.yml b/.github/workflows/issue_pr_lock.yml
index a5ba2f98d13d1a550a9b319701a843787c0118b7..bb1d5a4c60f86fa686d3d68099acebd61c0c9682 100644 (file)
--- a/.github/workflows/issue_pr_lock.yml
+++ b/.github/workflows/issue_pr_lock.yml
@@ -61,7 +61,7 @@ jobs:
           private-key: ${{ secrets.STALE_LOCKING_APP_PRIVATE_KEY }}
 
       # Ref: https://github.com/dessant/lock-threads#usage
-      - uses: dessant/lock-threads@v5
+      - uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # v5.0.1
         with:
           github-token: '${{ steps.generate-token.outputs.token }}'
           process-only: 'issues, prs'
@@ -73,7 +73,7 @@ jobs:
           log-output: true
       - if: failure()
         name: Send job failure notification e-mail
-        uses: dawidd6/action-send-mail@v3.12.0
+        uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
         with:
           server_address: ${{secrets.ACTION_MAIL_SERVER}}
           server_port: 465

diff --git a/.github/workflows/machine-os-pr.yml b/.github/workflows/machine-os-pr.yml
index 9667ab0e86b95592670784aa3c68ccf6a9f80527..c6455e898c229a9b88ed4c18148a911cc1d43153 100644 (file)
--- a/.github/workflows/machine-os-pr.yml
+++ b/.github/workflows/machine-os-pr.yml
@@ -144,6 +144,6 @@ jobs:
 
       - name: Comment PR link
         if: steps.getversion.outputs.update == 'true' && steps.checkpr.outputs.openpr == 'true'
-        uses: thollander/actions-comment-pull-request@v3
+        uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
         with:
           message: "Building images at: ${{ steps.pr.outputs.uri }}"

diff --git a/.github/workflows/release-artifacts.yml b/.github/workflows/release-artifacts.yml
index 68c0eaee4874760a2487b40902de3e78cc295a1c..704064826127ef56c3da10b4be77670a9ff74cd1 100644 (file)
--- a/.github/workflows/release-artifacts.yml
+++ b/.github/workflows/release-artifacts.yml
@@ -235,7 +235,7 @@ jobs:
 
       - name: Send release notification e-mail
         # Ref: https://github.com/dawidd6/action-send-mail
-        uses: dawidd6/action-send-mail@v3.12.0
+        uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
         with:
           server_address: ${{secrets.ACTION_MAIL_SERVER}}
           server_port: 465

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 825ced584f5d8f00d667968929f41a46550c755a..d88ea81b6c04bc7a6420d5d01b9d60e331c1b48e 100644 (file)
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -179,7 +179,7 @@ jobs:
         echo "TENANT_ID=${{secrets.AZ_TENANT_ID}}" | Out-File -FilePath $env:GITHUB_ENV -Append
         echo "CLIENT_SECRET=${{secrets.AZ_CLIENT_SECRET}}" | Out-File -FilePath $env:GITHUB_ENV -Append
     - name: Pandoc Setup
-      uses: r-lib/actions/setup-pandoc@v2
+      uses: r-lib/actions/setup-pandoc@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2.11.4
       with:
         pandoc-version: '3.1.11'
     # Note: Windows assigns a UUID to the installer at build time, it's assumed
@@ -359,7 +359,7 @@ jobs:
         run: cat email_body.txt
       - name: Send release notification e-mail
         # Ref: https://github.com/dawidd6/action-send-mail
-        uses: dawidd6/action-send-mail@v3.12.0
+        uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
         with:
           server_address: ${{secrets.ACTION_MAIL_SERVER}}
           server_port: 465

diff --git a/.github/workflows/upload-win-installer.yml b/.github/workflows/upload-win-installer.yml
index edf5a269501459abb40d41cd1dfb21d90a5ef731..d7a8b42099168b112dfa4e16df995de0d04c6eb2 100644 (file)
--- a/.github/workflows/upload-win-installer.yml
+++ b/.github/workflows/upload-win-installer.yml
@@ -101,7 +101,7 @@ jobs:
         echo "TENANT_ID=${{secrets.AZ_TENANT_ID}}" | Out-File -FilePath $env:GITHUB_ENV -Append
         echo "CLIENT_SECRET=${{secrets.AZ_CLIENT_SECRET}}" | Out-File -FilePath $env:GITHUB_ENV -Append
     - name: Pandoc Setup
-      uses: r-lib/actions/setup-pandoc@v2
+      uses: r-lib/actions/setup-pandoc@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2.11.4
       with:
         pandoc-version: '3.1.11'
     - name: Build