IONOS(CI): Pin GitHub Actions in build workflow

.github/workflows/build-artifact.yml

@@ -99,7 +99,7 @@ jobs:
           echo "Effective cache version: $EFFECTIVE_VERSION"
 
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           submodules: true
           fetch-depth: 1  # Shallow clone - only need current submodule SHAs for cache detection
@@ -278,14 +278,14 @@ jobs:
           echo "Building $APP_NAME from $APP_PATH (SHA: ${{ matrix.app_info.sha }})"
 
       - name: Checkout server
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           submodules: true
           fetch-depth: 1
 
       - name: Set up node with version from package.json's engines
         if: steps.app-config.outputs.has-npm == 'true'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # 6.4.0
         with:
           node-version-file: "package.json"
           cache: 'npm'
@@ -303,7 +303,7 @@ jobs:
 
       - name: Cache Composer dependencies for ${{ matrix.app_info.name }}
         if: steps.app-config.outputs.has-composer == 'true' && github.event.inputs.force_rebuild != 'true'
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # 6.1.0
         with:
           path: ${{ steps.app-config.outputs.path }}/vendor
           key: ${{ runner.os }}-composer-${{ matrix.app_info.name }}-${{ hashFiles(format('{0}/composer.lock', steps.app-config.outputs.path)) }}
@@ -324,7 +324,7 @@ jobs:
 
       # Save built app to cache for future runs
       - name: Save build artifacts to cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # 6.1.0
         with:
           path: ${{ steps.app-config.outputs.path }}
           key: ${{ needs.prepare-matrix.outputs.effective_cache_version }}-app-build-${{ matrix.app_info.name }}-${{ matrix.app_info.sha }}
@@ -447,7 +447,7 @@ jobs:
           echo "✓ Cleanup complete"
 
       - name: Upload ${{ matrix.app_info.name }} build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           retention-days: 1
           name: external-app-build-${{ matrix.app_info.name }}
@@ -473,13 +473,13 @@ jobs:
     name: build-artifact
     steps:
       - name: Checkout server
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           submodules: true
           fetch-depth: 1
 
       - name: Setup JFrog CLI
-        uses: jfrog/setup-jfrog-cli@7c95feb32008765e1b4e626b078dfd897c4340ad # v4.4.1
+        uses: jfrog/setup-jfrog-cli@1641575d87647fb969c0545f0b6a76873e328b7c # v5.0.0
         env:
           JF_URL: ${{ secrets.JF_ARTIFACTORY_URL }}
           JF_USER: ${{ secrets.JF_ARTIFACTORY_USER }}
@@ -631,7 +631,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
 
       - name: Set up node with version from package.json's engines
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # 6.4.0
         with:
           node-version-file: "package.json"
           cache: ${{ github.event.inputs.force_rebuild != 'true' && 'npm' || '' }}
@@ -643,7 +643,7 @@ jobs:
         run: make --version && node --version && npm --version
 
       - name: Setup PHP with PECL extension
-        uses: shivammathur/setup-php@c541c155eee45413f5b09a52248675b1a2575231 #v2.31.1
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #v2.37.2
         with:
           php-version: '8.3'
           tools: composer:v2
@@ -653,7 +653,7 @@ jobs:
 
       - name: Cache Composer dependencies
         if: github.event.inputs.force_rebuild != 'true'
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # 6.1.0
         with:
           path: vendor
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -696,7 +696,7 @@ jobs:
           echo "NC_VERSION=$NC_VERSION" >> $GITHUB_OUTPUT
 
       - name: Upload artifact result for job build-artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           retention-days: 30
           name: nextcloud_workspace_build_artifact
@@ -731,7 +731,7 @@ jobs:
     steps:
       # Checkout is required to access the local composite action at ./.github/actions/get-job-data
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           fetch-depth: 1
 
@@ -764,12 +764,12 @@ jobs:
           fi
 
       - name: Download artifact zip
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: nextcloud_workspace_build_artifact
 
       # This action sets up the JFrog CLI with the Artifactory URL and access token
-      - uses: jfrog/setup-jfrog-cli@7c95feb32008765e1b4e626b078dfd897c4340ad # v4.4.1
+      - uses: jfrog/setup-jfrog-cli@deda456d982fc5e9a7a020b63eb0d2968aedd33e # v5.1.0
         env:
           JF_URL: ${{ secrets.JF_ARTIFACTORY_URL }}
           JF_USER: ${{ secrets.JF_ARTIFACTORY_USER }}
@@ -912,20 +912,20 @@ jobs:
 
     steps:
       - name: Download artifact zip
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: nextcloud_workspace_build_artifact
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # 4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # 6.1.0
         with:
           images: "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
 
@@ -944,7 +944,7 @@ jobs:
           EOF
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           push: true
@@ -1061,7 +1061,7 @@ jobs:
           elif [[ "${{ github.ref_name }}" =~ ^.*/dev/.*$ ]]; then
               # Extract the part before '/dev/'
               BRANCH_PREFIX=$(echo "${{ github.ref_name }}" | sed 's|/.*||' | sed 's/[^A-Za-z0-9._-]/-/g')
-              BUILD_TYPE="dev-${BRANCH_PREFIX}" 
+              BUILD_TYPE="dev-${BRANCH_PREFIX}"
           fi
 
           # Construct source build URL for traceability