ci: harden GH Actions, pin versions to commits

Author: RobinKnipe

.github/workflows/check-pull-request.yml

@@ -23,20 +23,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
       - name: Setup npm
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24.18
           cache: npm
 
       - name: Install and audit
         run: |
           npm audit --omit=dev
-          npm ci
+          npm ci --ignore-scripts
           npm run postinstall
 
       - name: Verify semantic version bump
@@ -71,13 +71,15 @@ jobs:
       - name: Jest Coverage Comment (with base snapshot)
         if: steps.base-cov.outputs.available == 'true'
         uses: ArtiomTr/jest-coverage-report-action@v2
+        # NOTE: need to switch to vitest!
         with:
           test-script: npm test
           base-coverage-file: base-coverage/report.json
 
       - name: Jest Coverage Comment (no base snapshot)
         if: steps.base-cov.outputs.available != 'true'
         uses: ArtiomTr/jest-coverage-report-action@v2
+        # NOTE: need to switch to vitest!
         with:
           test-script: npm test
 
@@ -88,9 +90,9 @@ jobs:
         # TODO: re-enable mTLS tests when startup health check issue is resolved
         #  && npm run test:acceptance:proxy:mtls
 
-      - name: Sonarqube Cloud Scan
+      - name: Sonar Cloud Scan
         if: github.actor != 'dependabot[bot]'
-        uses: SonarSource/sonarqube-scan-action@v6
+        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/publish-hotfix.yml

@@ -18,29 +18,30 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0 # Depth 0 is required for branch-based versioning
 
       - name: Test code and Create Test Coverage Reports
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: npm
       - run: |
           npm audit --omit=dev
-          npm ci
+          npm ci --ignore-scripts
           npm run postinstall
           npm run lint
           npm test
 
       - name: Publish Hot Fix
-        uses: DEFRA/cdp-build-action/build-hotfix@main
+        uses: DEFRA/cdp-build-action/build-hotfix@f13fc42004f99a1df2e21ce1ff488cc72c897e40 # 17 Jul 2026
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
+      # FIXME: this step should be run before the tag publishing in case there are problems found!
       - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@v6
+        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/publish.yml

@@ -19,17 +19,17 @@ jobs:
     name: Snapshot base coverage for PR comparison
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: npm
       - run: |
-          npm ci
+          npm ci --ignore-scripts
           npm run postinstall
       - name: Run unit + graphql tests with coverage
         run: npm test -- --ci --json --testLocationInResults --outputFile=report.json
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: coverage-report-main
           path: report.json
@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
@@ -56,7 +56,7 @@ jobs:
           echo "value=${VERSION}" >> $GITHUB_OUTPUT
 
       - name: Build and Publish
-        uses: DEFRA/cdp-build-action/build@main
+        uses: DEFRA/cdp-build-action/build@f13fc42004f99a1df2e21ce1ff488cc72c897e40 # 17 Jul 2026
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           version: ${{ steps.version.outputs.value }}
@@ -67,7 +67,7 @@ jobs:
           git push --tags
 
       - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@v6
+        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}