Pin action version to SHA

Author: Alex Wang

.github/workflows/build.yml

@@ -62,22 +62,22 @@ jobs:
 
       - name: Generate JaCoCo Badge
         if: ${{ github.ref == 'refs/heads/main' && matrix.java == 17 }}
-        uses: cicirello/jacoco-badge-generator@v2
+        uses: cicirello/jacoco-badge-generator@3bbf7f5f44bbe1e64d7d703b09f8f16abd4164e2 # v2
         with:
           jacoco-csv-file: coverage-report/target/site/jacoco-aggregate/jacoco.csv
           badges-directory: coverage-report/target/site/jacoco-aggregate
 
       - name: Publish coverage report to GitHub Pages
         if: ${{ github.ref == 'refs/heads/main' && matrix.java == 17 }}
-        uses: JamesIves/github-pages-deploy-action@v4
+        uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4
         with:
           branch: docs
           folder: coverage-report/target/site/jacoco-aggregate
           target-folder: coverage
 
       - name: Deploy javadoc to Github Pages
         if: ${{ github.ref == 'refs/heads/main' && matrix.java == 17 }}
-        uses: MathieuSoysal/Javadoc-publisher.yml@v3.0.2
+        uses: MathieuSoysal/Javadoc-publisher.yml@fda475b197081ba1eca7a1dfadf0c017080a1623 # v3.0.2
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           javadoc-branch: docs

.github/workflows/notify_slack.yml

@@ -18,7 +18,7 @@ jobs:
           node-version: '24.x'
       - name: Send issue notification to Slack
         if: github.event_name == 'issues'
-        uses: slackapi/slack-github-action@v3.0.1
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK_URL_ISSUE }}
           webhook-type: incoming-webhook
@@ -31,7 +31,7 @@ jobs:
 
       - name: Send pull request notification to Slack
         if: github.event_name == 'pull_request_target'
-        uses: slackapi/slack-github-action@v3.0.1
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK_URL_PR }}
           webhook-type: incoming-webhook

.github/workflows/release_maven.yml

@@ -60,15 +60,15 @@ jobs:
           git commit -m "chore: release version ${{ github.event.inputs.release_version }}"
       
       - name: Push changes
-        uses: ad-m/github-push-action@master
+        uses: ad-m/github-push-action@4cc74773234f74829a8c21bc4d69dd4be9cfa599 # master
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build artifacts
         run: mvn clean install -q -Dlog4j2.level=WARN -Dlog4j.configurationFile=log4j2-quiet.xml --no-transfer-progress
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2
         with:
           tag_name: v${{ github.event.inputs.release_version }}
           name: Release v${{ github.event.inputs.release_version }}
@@ -100,6 +100,6 @@ jobs:
           git commit -m "chore: bump version to ${{ github.event.inputs.next_version }}"
       
       - name: Push changes
-        uses: ad-m/github-push-action@master
+        uses: ad-m/github-push-action@4cc74773234f74829a8c21bc4d69dd4be9cfa599 # master
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}