chore(security): pin external GitHub Actions to commit SHAs (#276)

Pin external third-party actions to full-length commit SHAs with a trailing
version comment to mitigate mutable-tag supply-chain attacks. Internal
SecureAuthCorp/* references intentionally left on floating tags.

No functional change: each SHA resolves to the commit the existing tag points to.

DEVOPS-8397

Author: rharasani-sa

.github/workflows/extract.yml

@@ -17,9 +17,9 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "22"
 
@@ -55,9 +55,9 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "22"
 

.github/workflows/test-android.yml

@@ -24,7 +24,7 @@ jobs:
     outputs:
       matrix: ${{ steps.find.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         # Default shallow checkout — we only need the working tree for `find`
         # below, not git history. The PR's changed files come from gh api.
       - id: find
@@ -81,10 +81,10 @@ jobs:
       matrix:
         android_dir: ${{ fromJson(needs.find-projects.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
         with:
           distribution: "temurin"
           java-version: "17"
@@ -129,7 +129,7 @@ jobs:
       # React Native samples need their JS deps installed first so autolinking
       # can resolve native modules from node_modules. Detect by walking up to
       # the directory that owns package.json.
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "22"
       - name: Enable Corepack
@@ -160,7 +160,7 @@ jobs:
             -dname "CN=Android Debug,O=Android,C=US"
 
       - name: Cache Gradle
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: |
             ~/.gradle/caches

.github/workflows/test-dotnet.yml

@@ -24,7 +24,7 @@ jobs:
     outputs:
       matrix: ${{ steps.find.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         # Default shallow checkout — we only need the working tree for `find`
         # below, not git history. The PR's changed files come from gh api.
       - id: find
@@ -65,8 +65,8 @@ jobs:
       matrix:
         project: ${{ fromJson(needs.find-projects.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-dotnet@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5
         with:
           dotnet-version: "10.0.x"
       - name: Restore

.github/workflows/test-ios.yml

@@ -21,7 +21,7 @@ jobs:
     outputs:
       matrix: ${{ steps.find.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - id: find
         env:
           EVENT_NAME: ${{ github.event_name }}
@@ -79,7 +79,7 @@ jobs:
       matrix:
         project: ${{ fromJson(needs.find-projects.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Detect project type
         id: type
@@ -99,7 +99,7 @@ jobs:
       # Cache the SPM source archives so cold resolves stay fast.
       - name: Cache SwiftPM (native iOS)
         if: steps.type.outputs.type == 'native'
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: |
             ~/Library/Caches/org.swift.swiftpm
@@ -117,7 +117,7 @@ jobs:
       # must be installed first.
       - name: Set up Node (RN iOS)
         if: steps.type.outputs.type == 'rn'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "22"
       - name: Enable Corepack (RN iOS)
@@ -139,7 +139,7 @@ jobs:
       # the right Pods/ for the matrix entry's Podfile.lock.
       - name: Cache CocoaPods (RN iOS)
         if: steps.type.outputs.type == 'rn'
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: ~/Library/Caches/CocoaPods
           key: pods-${{ runner.os }}-${{ hashFiles(format('{0}/Podfile.lock', matrix.project)) }}

.github/workflows/test-java.yml

@@ -24,7 +24,7 @@ jobs:
     outputs:
       matrix: ${{ steps.find.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         # Default shallow checkout — we only need the working tree for `find`
         # below, not git history. The PR's changed files come from gh api.
       - id: find
@@ -65,8 +65,8 @@ jobs:
       matrix:
         project: ${{ fromJson(needs.find-projects.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
         with:
           distribution: "temurin"
           java-version: "21"

.github/workflows/test-js.yml

@@ -24,7 +24,7 @@ jobs:
     outputs:
       matrix: ${{ steps.find.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         # Default shallow checkout — we only need the working tree for `find`
         # below, not git history. The PR's changed files come from gh api.
       - id: find
@@ -71,8 +71,8 @@ jobs:
       matrix:
         project: ${{ fromJson(needs.find-projects.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "22"
       - name: Enable Corepack