Upgrade and pin GitHub Actions

filiphr · filiphr · commit 078b50d9dda2 · 2026-02-23T15:18:25.000+01:00
diff --git a/.github/workflows/db2.yml b/.github/workflows/db2.yml
@@ -38,8 +38,8 @@ jobs:
           --health-timeout 40s
           --health-retries 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'zulu'
           java-version: 17
@@ -62,7 +62,7 @@ jobs:
           -Dspring.datasource.password=flowable
           -Dmaven.test.redirectTestOutputToFile=false
       - name: Upload test artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         if: ${{ failure() && steps.test.conclusion == 'failure' }}
         with:
           name: surefire-test-reports-db2-${{ matrix.db2 }}
diff --git a/.github/workflows/distro-check.yml b/.github/workflows/distro-check.yml
@@ -15,21 +15,21 @@ jobs:
     name: Linux JDK 21
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-java@v3
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
       with:
         distribution: 'zulu'
         java-version: 21
     - name: Cache Maven Repository
-      uses: actions/cache@v3
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: ~/.m2
         key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
         restore-keys: ${{ runner.os }}-m2
     - name: Verify Distribution
       run: ./mvnw verify -Pdeploy ${MAVEN_ARGS} -T 1C -DskipTests=true -Dgpg.skip=true
     - name: Upload Distribution Artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: flowable-distribution-artifact
         path: 'distro/target/flowable-*.zip'
diff --git a/.github/workflows/docker-flowable-base-image-java.yml b/.github/workflows/docker-flowable-base-image-java.yml
@@ -12,30 +12,30 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Log into dockerhub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: ./docker/base-image
           platforms: linux/amd64,linux/arm64
           push: true
           tags: flowable/flowable-jre:21
 
       - name: Scan image
-        uses: anchore/scan-action@v6
+        uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # v7.3.2
         with:
           image: flowable/flowable-jre:21
           output-format: 'table'
diff --git a/.github/workflows/docker-release-with-latest.yml b/.github/workflows/docker-release-with-latest.yml
@@ -8,10 +8,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'temurin'
           java-version: '21'
@@ -30,13 +30,13 @@ jobs:
           -B -V --no-transfer-progress
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v3.7.0
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
 
       - name: Write signing key to disk
         run: echo "${{ secrets.SIGNING_SECRET }}" > cosign.key
 
       - name: Log into dockerhub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
@@ -8,10 +8,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'temurin'
           java-version: '21'
@@ -30,13 +30,13 @@ jobs:
           -B -V --no-transfer-progress
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v3.7.0
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
 
       - name: Write signing key to disk
         run: echo "${{ secrets.SIGNING_SECRET }}" > cosign.key
 
       - name: Log into dockerhub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.github/workflows/flowable5.yml b/.github/workflows/flowable5.yml
@@ -18,8 +18,8 @@ jobs:
         -B
         --no-transfer-progress
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-java@v3
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
       with:
         distribution: 'zulu'
         java-version: 17
diff --git a/.github/workflows/graal-native.yml b/.github/workflows/graal-native.yml
@@ -16,13 +16,13 @@ jobs:
     name: Linux Graal Native
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: graalvm/setup-graalvm@v1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: graalvm/setup-graalvm@54b4f5a65c1a84b2fdfdc2078fe43df32819e4b1 # v1.4.5
       with:
         java-version: 17
         distribution: graalvm
     - name: Cache Maven Repository
-      uses: actions/cache@v3
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: ~/.m2
         key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
diff --git a/.github/workflows/helm-release.yml b/.github/workflows/helm-release.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
@@ -20,12 +20,12 @@ jobs:
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
       - name: Install Helm
-        uses: azure/setup-helm@v1
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
         with:
           version: v3.4.0
 
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.2.1
+        uses: helm/chart-releaser-action@c25b74a986eb925b398320414b576227f375f946 # v1.2.1
         with:
           charts_dir: k8s/flowable
           charts_repo_url: https://flowable.github.io/helm/
diff --git a/.github/workflows/java-ea.yml b/.github/workflows/java-ea.yml
@@ -16,15 +16,15 @@ jobs:
     name: Linux (OpenJDK EA)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Cache Maven Repository
-        uses: actions/cache@v3
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
           restore-keys: ${{ runner.os }}-m2
       - name: 'Set up JDK'
-        uses: oracle-actions/setup-java@v1
+        uses: oracle-actions/setup-java@fff43251af9936a0e6a4d5d0946e14f1680e9b6b # v1.5.0
         with:
           website: jdk.java.net
           release: EA
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -16,13 +16,13 @@ jobs:
       matrix:
         java: [17, 21, 25]
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-java@v3
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
       with:
         distribution: 'zulu'
         java-version: ${{ matrix.java }}
     - name: Cache Maven Repository
-      uses: actions/cache@v3
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: ~/.m2
         key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
@@ -34,12 +34,12 @@ jobs:
       run: ./mvnw verify -Pdistro,errorLogging,include-spring-boot-samples ${MAVEN_ARGS} -Dmaven.test.redirectTestOutputToFile=true
     - name: Publish Test Results
       if: always()   # important: runs even if tests fail
-      uses: EnricoMi/publish-unit-test-result-action@v2.22.0
+      uses: EnricoMi/publish-unit-test-result-action@27d65e188ec43221b20d26de30f4892fad91df2f # v2.22.0
       with:
         files: |
           **/target/surefire-reports/*.xml
     - name: Upload Surefire reports
-      uses: actions/upload-artifact@v6.0.0
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: success() || failure() # always run even if the previous step fails
       with:
         name: surefire-${{matrix.java}}-txt
diff --git a/.github/workflows/mariadb.yml b/.github/workflows/mariadb.yml
@@ -36,8 +36,8 @@ jobs:
     steps:
       - name: "Set MariaDB collation"
         run: docker exec ${{ job.services.mariadb.id }} sh -c 'mariadb --user=flowable --password=flowable --database=flowable --execute="alter database flowable character set utf8mb4 collate utf8mb4_bin"'
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'zulu'
           java-version: 17
@@ -59,7 +59,7 @@ jobs:
           -Dspring.datasource.password=flowable
           -Dmaven.test.redirectTestOutputToFile=false
       - name: Upload test artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         if: ${{ failure() && steps.test.conclusion == 'failure' }}
         with:
           name: surefire-test-reports-mariadb-${{ matrix.mariadb }}
diff --git a/.github/workflows/mysql.yml b/.github/workflows/mysql.yml
@@ -36,8 +36,8 @@ jobs:
     steps:
       - name: "Set MySQL collation"
         run: docker exec ${{ job.services.mysql.id }} sh -c 'mysql --user=flowable --password=flowable --database=flowable --execute="alter database flowable character set utf8mb4 collate utf8mb4_bin"'
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'zulu'
           java-version: 17
@@ -59,7 +59,7 @@ jobs:
           -Dspring.datasource.password=flowable
           -Dmaven.test.redirectTestOutputToFile=false
       - name: Upload test artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         if: ${{ failure() && steps.test.conclusion == 'failure' }}
         with:
           name: surefire-test-reports-mysql-${{ matrix.mysql }}
diff --git a/.github/workflows/oracle.yml b/.github/workflows/oracle.yml
@@ -46,8 +46,8 @@ jobs:
           --health-timeout 10s
           --health-retries 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'zulu'
           java-version: 17
@@ -72,7 +72,7 @@ jobs:
           -Doracle.jdbc.artifact=${{ matrix.driverArtifact }}
           -Dmaven.test.redirectTestOutputToFile=false
       - name: Upload test artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         if: ${{ failure() && steps.test.conclusion == 'failure' }}
         with:
           name: surefire-test-reports-oracle-${{ matrix.oracle }}
diff --git a/.github/workflows/postgres.yml b/.github/workflows/postgres.yml
@@ -31,8 +31,8 @@ jobs:
         # needed because the postgres container does not provide a health check
         options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5 --tmpfs /var/lib/postgresql/data:rw
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'zulu'
           java-version: 17
@@ -55,7 +55,7 @@ jobs:
           -Dspring.datasource.password=flowable
           -Dmaven.test.redirectTestOutputToFile=false
       - name: Upload test artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         if: ${{ failure() && steps.test.conclusion == 'failure' }}
         with:
           name: surefire-test-reports-postgres-${{ matrix.postgres }}
diff --git a/.github/workflows/sql-server.yml b/.github/workflows/sql-server.yml
@@ -36,15 +36,15 @@ jobs:
           --health-timeout 5s
           --health-retries 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Prepare Database
         run: ./.github/actions/scripts/prepare-mssql.sh
         env:
           # use localhost for the host here because we have specified a vm for the job.
           # If we were running the job on a container this would be mssql
           MSSQL_HOST: localhost
           MSSQL_PORT: ${{ job.services.mssql.ports[1433] }} # get randomly assigned published port
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'zulu'
           java-version: 17
@@ -67,7 +67,7 @@ jobs:
           -Dspring.datasource.password=flowable
           -Dmaven.test.redirectTestOutputToFile=false
       - name: Upload test artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         if: ${{ failure() && steps.test.conclusion == 'failure' }}
         with:
           name: surefire-test-reports-${{ matrix.mssql }}
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
@@ -15,14 +15,14 @@ jobs:
     name: 'Windows'
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: 'Set up JDK 17'
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'zulu'
           java-version: 17
       - name: Cache Maven Repository
-        uses: actions/cache@v3
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
