Merge pull request #418 from jolicode/action-up

Update GitHub Actions, harden security

Author: pyrech

.github/workflows/cache.yml

@@ -19,16 +19,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log in to registry
         shell: bash
         run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u $ --password-stdin
 
       - name: setup-castor
-        uses: castor-php/setup-castor@v1.0.0
+        uses: castor-php/setup-castor@827c7ae1be0bb45e42a6082cad943a2afe0ffd40 # v1.0.0
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
 
       - name: "Build and start the infrastructure"

.github/workflows/ci.yml

@@ -28,10 +28,12 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout
-              uses: actions/checkout@v6
+              uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+              with:
+                persist-credentials: false
 
             - name: Check php/Dockerfile
-              uses: hadolint/hadolint-action@v3.3.0
+              uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
               with:
                   dockerfile: infrastructure/docker/services/php/Dockerfile
 
@@ -46,16 +48,18 @@ jobs:
             DS_PHP_VERSION: ${{ matrix.php-version }}
         steps:
             - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@v4
+              uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
             - name: Log in to registry
               shell: bash
               run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u $ --password-stdin
 
             - name: setup-castor
-              uses: castor-php/setup-castor@v1.0.0
+              uses: castor-php/setup-castor@827c7ae1be0bb45e42a6082cad943a2afe0ffd40 # v1.0.0
 
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+              with:
+                persist-credentials: false
 
             - name: "Build and start the infrastructure"
               run: "castor start"