Pin dependencies

.github/workflows/REUSE.yaml

@@ -14,8 +14,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - name: REUSE Compliance Check
-        uses: fsfe/reuse-action@v6
+        uses: fsfe/reuse-action@v6.0.0

.github/workflows/ci.yml

@@ -123,12 +123,12 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
 
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v6.5.0
         with:
           go-version-file: tests/go.mod
           cache: true
@@ -138,11 +138,11 @@ jobs:
         uses: ./.github/actions/setup-tools
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v4.2.0
         continue-on-error: true
 
       - name: Log in to GHCR (read-only)
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.3.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -162,16 +162,16 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v4.2.0
         continue-on-error: true
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.3.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -191,17 +191,17 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
 
       - name: Install host-side tools (vault, bats)
         uses: ./.github/actions/setup-tools
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v4.2.0
         continue-on-error: true
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.3.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -232,7 +232,7 @@ jobs:
 
       - name: Upload BATS logs on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: bats-logs-${{ github.run_id }}
           path: logs/
@@ -319,10 +319,10 @@ jobs:
             doc: uc7-fru-discovery.md
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
 
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v6.5.0
         with:
           go-version-file: tests/go.mod
           cache: true
@@ -332,11 +332,11 @@ jobs:
         uses: ./.github/actions/setup-tools
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v4.2.0
         continue-on-error: true
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.3.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -401,7 +401,7 @@ jobs:
 
       - name: Upload artifacts
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: ${{ matrix.id }}-logs-${{ github.run_id }}
           path: |

.github/workflows/golangci-lint.yaml

@@ -19,14 +19,14 @@ jobs:
       run:
         working-directory: tests
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v6.5.0
         with:
           go-version-file: tests/go.mod
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@v9.3.0
         with:
           # `version` is the golangci-lint *binary* version, not the action.
           # Pinned so it stays in sync with the v2 schema in tests/.golangci.yml.

.github/workflows/sandbox-consumer.example.yaml

@@ -37,29 +37,29 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Check out the consumer repo (the service under test)
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
         with:
           path: service
           fetch-depth: 0
 
       - name: Check out the sandbox harness
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
         with:
           repository: OpenCHAMI/integration-sandbox
           path: integration-sandbox
           # Optional: pin to a sandbox release tag instead of main.
           # ref: v1.0.0
 
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v6.5.0
         with:
           go-version: "1.24.6"
 
       - name: Install bats
         run: sudo apt-get update && sudo apt-get install -y bats
 
       - name: Log in to GHCR (read-only)
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.3.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -89,7 +89,7 @@ jobs:
 
       - name: Upload log bundle on failure
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: sandbox-logs
           path: integration-sandbox/logs/

.github/workflows/stale.yaml

@@ -17,7 +17,7 @@ jobs:
   run-stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@v10.3.0
         with:
           days-before-stale: 35
           days-before-close: 7