Merge pull request #290 from com-pas/feat/harden-github-actions

fix: update GitHub Actions to specific commit versions

Author: noraeb

.github/workflows/auto-alignment-aws.yml

@@ -15,10 +15,10 @@ jobs:
     environment: aws
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 #v6
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -32,7 +32,7 @@ jobs:
           key-path: '["services", "scl-auto-alignment", "image"]'
       - name: Render CoMPAS OpenSCD Container
         id: render-auto-alignment
-        uses: aws-actions/amazon-ecs-render-task-definition@v1
+        uses: aws-actions/amazon-ecs-render-task-definition@6b89923a897d41e9ad789181d8865b532ecf973c #v1
         with:
           task-definition: ${{ github.workspace }}/aws/task-definitions/compas-auto-alignment.json
           container-name: CoMPAS-Scl-Auto-Alignment
@@ -42,7 +42,7 @@ jobs:
             JWT_VERIFY_ISSUER=${{ secrets.JWT_VERIFY_ISSUER }}
 
       - name: Deploy to Amazon ECS service
-        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
+        uses: aws-actions/amazon-ecs-deploy-task-definition@cbf54ec46642b86ff78c2f5793da6746954cf8ff #v2
         with:
           task-definition: ${{ steps.render-auto-alignment.outputs.task-definition }}
           service: scl-auto-alignment

.github/workflows/cim-mapping-aws.yml

@@ -15,10 +15,10 @@ jobs:
     environment: aws
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 #v6
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -32,7 +32,7 @@ jobs:
           key-path: '["services", "cim-mapping", "image"]'
       - name: Render CoMPAS OpenSCD Container
         id: render-cim-mapping
-        uses: aws-actions/amazon-ecs-render-task-definition@v1
+        uses: aws-actions/amazon-ecs-render-task-definition@6b89923a897d41e9ad789181d8865b532ecf973c #v1
         with:
           task-definition: ${{ github.workspace }}/aws/task-definitions/compas-cim-mapping.json
           container-name: CoMPAS-Cim-Mapping
@@ -42,7 +42,7 @@ jobs:
             JWT_VERIFY_ISSUER=${{ secrets.JWT_VERIFY_ISSUER }}
 
       - name: Deploy to Amazon ECS service
-        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
+        uses: aws-actions/amazon-ecs-deploy-task-definition@cbf54ec46642b86ff78c2f5793da6746954cf8ff #v2
         with:
           task-definition: ${{ steps.render-cim-mapping.outputs.task-definition }}
           service: Compas-Cim-Mapping

.github/workflows/compas-openscd-aws.yml

@@ -15,10 +15,10 @@ jobs:
     environment: aws
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 #v6
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -32,14 +32,14 @@ jobs:
           key-path: '["services", "open-scd", "image"]'
       - name: Render CoMPAS OpenSCD Container
         id: render-compas-openscd
-        uses: aws-actions/amazon-ecs-render-task-definition@v1
+        uses: aws-actions/amazon-ecs-render-task-definition@6b89923a897d41e9ad789181d8865b532ecf973c #v1
         with:
           task-definition: ${{ github.workspace }}/aws/task-definitions/compas-openscd.json
           container-name: CoMPAS-OpenSCD
           image: ${{ steps.read_docker_compose.outputs.data }}
 
       - name: Deploy to Amazon ECS service
-        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
+        uses: aws-actions/amazon-ecs-deploy-task-definition@cbf54ec46642b86ff78c2f5793da6746954cf8ff #v2
         with:
           task-definition: ${{ steps.render-compas-openscd.outputs.task-definition }}
           service: CoMPAS-Open-SCD

.github/workflows/data-service-aws.yml

@@ -15,10 +15,10 @@ jobs:
     environment: aws
     steps:
       - name: checkout
-        uses: actions/checkout@v6 
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 #v6
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -32,7 +32,7 @@ jobs:
           key-path: '["services", "scl-data-service", "image"]'
       - name: Render CoMPAS SCL Data Service Container
         id: render-scl-data-service
-        uses: aws-actions/amazon-ecs-render-task-definition@v1
+        uses: aws-actions/amazon-ecs-render-task-definition@6b89923a897d41e9ad789181d8865b532ecf973c #v1
         with:
           task-definition: ${{ github.workspace }}/aws/task-definitions/compas-scl-data-service.json
           container-name: CoMPAS-Scl-Data-Service
@@ -47,7 +47,7 @@ jobs:
 
       - name: Modify Amazon ECS task definition with postgres container
         id: render-postgres
-        uses: aws-actions/amazon-ecs-render-task-definition@v1
+        uses: aws-actions/amazon-ecs-render-task-definition@6b89923a897d41e9ad789181d8865b532ecf973c #v1
         with:
           task-definition: ${{ steps.render-scl-data-service.outputs.task-definition }}
           container-name: Postgresql

.github/workflows/release-please.yml

@@ -16,7 +16,7 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      - uses: google-github-actions/release-please-action@v4
+      - uses: google-github-actions/release-please-action@e4dc86ba9405554aeba3c6bb2d169500e7d3b4ee #v4
         with:
           release-type: simple
           package-name: compas-deployment