ci: pin GitHub Actions to commit SHAs for supply-chain hardening

Author: ajsb85

.github/workflows/ci.yml

@@ -18,20 +18,20 @@ jobs:
     name: Build and test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
         with:
           distribution: temurin
           java-version: "25"
-      - uses: android-actions/setup-android@v4
+      - uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4
       - name: Install SDK packages
         run: sdkmanager "platforms;android-35" "build-tools;36.0.0"
       - name: Test, lint, and assemble
         run: >-
           ./gradlew :cobs:testDebugUnitTest :cobs:lint :cobs:assembleRelease
           --console=plain
       - name: Upload AAR artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: cobs_codec_kt-aar
           path: cobs/build/outputs/aar/*.aar
@@ -40,12 +40,12 @@ jobs:
     name: Conformance vectors
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
         with:
           distribution: temurin
           java-version: "25"
-      - uses: android-actions/setup-android@v4
+      - uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4
       - name: Install SDK packages
         run: sdkmanager "platforms;android-35" "build-tools;36.0.0"
       - name: Download shared conformance vectors

.github/workflows/commit-lint.yml

@@ -12,7 +12,7 @@ jobs:
     name: Conventional Commits
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
       - name: Check commit subjects follow Conventional Commits

.github/workflows/publish-maven.yml

@@ -15,12 +15,12 @@ jobs:
     name: Publish Maven package
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
         with:
           distribution: temurin
           java-version: "25"
-      - uses: android-actions/setup-android@v4
+      - uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4
       - name: Install SDK packages
         run: sdkmanager "platforms;android-35" "build-tools;36.0.0"
       - name: Test and publish to GitHub Packages

.github/workflows/release-aar.yml

@@ -14,12 +14,12 @@ jobs:
     name: Build AAR and attach to release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
         with:
           distribution: temurin
           java-version: "25"
-      - uses: android-actions/setup-android@v4
+      - uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4
       - name: Install SDK packages
         run: sdkmanager "platforms;android-35" "build-tools;36.0.0"
       - name: Build AAR and run unit tests
@@ -33,13 +33,13 @@ jobs:
           cp cobs/build/outputs/aar/cobs-release.aar "dist/cobs_codec-${version}.aar"
           echo "version=$version" >> "$GITHUB_OUTPUT"
       - name: Upload as workflow artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: cobs_codec-aar-release
           path: dist/*.aar
       - name: Attach to GitHub release
         if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
         with:
           files: dist/*.aar
           name: cobs_codec ${{ steps.stage.outputs.version }}