PLAT-385: Update actions to latest pinned versions and hashes (#2804)

Author: timm088

.github/actions/setup-playwright/action.yaml

@@ -20,7 +20,7 @@ runs:
         
     - name: Cache Playwright Browsers
       id: cache-playwright-browsers
-      uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # pin@v5.0.3
       with:
         path: ~/.cache/ms-playwright
         key: playwright-browsers-${{ runner.os }}-${{ env.PLAYWRIGHT_VERSION }}

.github/actions/setup/action.yaml

@@ -5,13 +5,13 @@ runs:
   using: "composite"
   steps:
     - name: Derive appropriate SHAs for base and head for `nx affected` commands
-      uses: nrwl/nx-set-shas@e2e6dc8bce4b0387a05eb687735c39c41580b792
+      uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # pin@v4.4.0
 
     - name: Setup pnpm
       uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
 
     - name: Use Node.js
-      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a
+      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # pin@v6.3.0
       with:
         node-version-file: ".nvmrc"
         registry-url: https://registry.npmjs.org/

.github/workflows/build-game-bridge.yaml

@@ -43,7 +43,7 @@ jobs:
     steps:
       - name: Checkout SDK Repository
         id: checkout-sdk
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.1
         with:
           ref: "${{ env.TS_SDK_TAG }}"
           fetch-depth: 0
@@ -93,13 +93,13 @@ jobs:
         run: pnpm nx run @imtbl/game-bridge:build --skip-nx-cache
 
       - name: Cache build artifacts
-        uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # pin@v5.0.3
         with:
           path: ./packages/game-bridge/dist
           key: "${{ runner.os }}-game-bridge-build-${{ env.TS_SDK_TAG }}"
 
       - name: Upload Game Bridge Build
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # pin@v7.0.0
         with:
           path: ./packages/game-bridge/dist
 
@@ -110,7 +110,7 @@ jobs:
     runs-on: ubuntu-latest-4-cores
     steps:
       - name: Checkout SDK Repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.1
         with:
           token: ${{ env.GH_TOKEN }}
           ref: "${{ env.TS_SDK_TAG }}"
@@ -122,7 +122,7 @@ jobs:
 
       - name: Restore Cached Build Artifacts
         id: restore-cache-game-bridge-build
-        uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # pin@v5.0.3
         with:
           path: ./packages/game-bridge/dist
           key: ${{ runner.os }}-game-bridge-build-${{ env.TS_SDK_TAG }}
@@ -132,7 +132,7 @@ jobs:
         run: echo "Game Bridge build cache not restored, exiting" && exit 1
 
       - name: Checkout Unity SDK Repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.1
         with:
           repository: immutable/unity-immutable-sdk
           token: ${{ env.GH_TOKEN }}
@@ -185,7 +185,7 @@ jobs:
     runs-on: ubuntu-latest-4-cores
     steps:
       - name: Checkout SDK Repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.1
         with:
           token: ${{ env.GH_TOKEN }}
           ref: "${{ env.TS_SDK_TAG }}"
@@ -197,7 +197,7 @@ jobs:
 
       - name: Restore Cached Build Artifacts
         id: restore-cache-game-bridge-build
-        uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # pin@v5.0.3
         with:
           path: ./packages/game-bridge/dist
           key: ${{ runner.os }}-game-bridge-build-${{ env.TS_SDK_TAG }}
@@ -207,7 +207,7 @@ jobs:
         run: echo "Game Bridge build cache not restored, exiting" && exit 1
 
       - name: Checkout Unreal SDK Repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.1
         with:
           repository: immutable/unreal-immutable-sdk
           token: ${{ env.GH_TOKEN }}

.github/workflows/dependency-review.yaml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.1
       - name: Dependency Review
         uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019
         with:

.github/workflows/passport-sdk-sample-app-deployment.yaml

@@ -21,13 +21,13 @@ jobs:
       NX_CLOUD_ACCESS_TOKEN: ${{ secrets.TS_IMMUTABLE_SDK_NX_TOKEN }}
     steps:
       - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838
+        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # pin@v4.1.0
         with:
           role-to-assume: ${{ secrets.AWS_IMMUTABLE_PROD_ADMIN_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
 
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.1
         with:
           fetch-depth: 0
 

.github/workflows/pr.yaml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest-4-cores
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.1
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           fetch-depth: 0
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest-8-cores
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.1
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           fetch-depth: 0
@@ -51,7 +51,7 @@ jobs:
       NODE_OPTIONS: --max-old-space-size=14366
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.1
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           fetch-depth: 0
@@ -114,7 +114,7 @@ jobs:
       ZKEVM_CHAIN_NAME: "imtbl-zkevm-testnet"
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.1
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           fetch-depth: 0

.github/workflows/publish-docs.yaml

@@ -21,7 +21,7 @@ jobs:
       is_alpha: ${{ steps.alpha_check.outputs.is_alpha }}
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.1
         with:
           fetch-depth: 0
 
@@ -64,12 +64,12 @@ jobs:
         run: failure("SDK reference docs should be only published from main branch, current branch ${{ github.ref }}")
 
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.1
         with:
           fetch-depth: 0
 
       - name: Checkout Docs Repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.1
         with:
           repository: immutable/docs
           token: ${{ secrets.TS_IMMUTABLE_SDK_GITHUB_TOKEN }}

.github/workflows/publish-example-tutorials.yaml

@@ -22,13 +22,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout SDK Repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.1
         with:
           fetch-depth: 0
           ref: main
 
       - name: Checkout Docs Repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.1
         with:
           repository: immutable/docs
           token: ${{ secrets.TS_IMMUTABLE_SDK_GITHUB_TOKEN }}

.github/workflows/publish.yaml

@@ -85,7 +85,7 @@ jobs:
         run: exit 1
 
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.1
         with:
           fetch-depth: 0
           token: ${{ secrets.TS_IMMUTABLE_SDK_GITHUB_TOKEN }}
@@ -112,7 +112,7 @@ jobs:
 
       # ! Do NOT remove any of these attestation subject paths - this will cause a Sev 0 incident !
       - name: Generate SDK Package Attestations
-        uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # pin@v4.1.0
         with:
           subject-path: ./imtbl-*.tgz
 

.github/workflows/stale-issues.yaml

@@ -11,11 +11,11 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # pin@v10.2.0
         with:
           stale-issue-message: 'This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
           days-before-issue-stale: 30
           days-before-pr-stale: -1
           days-before-issue-close: 5
           days-before-pr-close: -1
-          stale-issue-labe: 'stale'
+          stale-issue-labe: 'stale'