update actions and use hashes instead of version tag

.github/workflows/ci.yml

@@ -1,5 +1,8 @@
 name: LocalStack Test
 on:
+  push:
+    branches:
+      - 'main'
   pull_request:
     paths-ignore:
       - ./*.md

ephemeral/shutdown/action.yml

@@ -14,7 +14,7 @@ runs:
   using: composite
   steps:
     - name: Download PR artifact
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
       with:
         name: pr-id
 
@@ -69,7 +69,7 @@ runs:
         retry shutdown_instance
 
     - name: Update status comment
-      uses: actions-cool/maintain-one-comment@v3.1.1
+      uses: actions-cool/maintain-one-comment@4b2dbf086015f892dcb5e8c1106f5fccd6c1476b # v3
       with:
         token: ${{ inputs.github-token }}
         body: |

ephemeral/startup/action.yml

@@ -40,7 +40,7 @@ runs:
           }
 
     - name: Download PR artifact
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
       with:
         name: pr-id
 
@@ -143,7 +143,7 @@ runs:
         echo "AWS_ENDPOINT_URL=$endpointUrl" >> $GITHUB_ENV
 
     - name: Upload preview instance URL
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
       with:
         name: preview-instance-url
         path: ./ls-preview-url.txt

finish/action.yml

@@ -21,14 +21,14 @@ runs:
     # Try to get pr artifact from current workflow
     - name: Download current PR artifact
       id: get-pr-artifact
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
       continue-on-error: true
       with:
         name: pr-id
 
     # If the above fails, try to get the latest pr artifact from the PR related workflows
     - name: Download latest PR artifact
-      uses: dawidd6/action-download-artifact@v6
+      uses: dawidd6/action-download-artifact@0bd50d53a6d7fb5cb921e607957e9cc12b4ce392 # v12
       if: ${{ steps.get-pr-artifact.outcome == 'failure' }}
       with:
         name: pr-id
@@ -44,13 +44,13 @@ runs:
     - name: Download preview instance URL
       id: get-preview-instance-url-artifact
       if: inputs.include-preview
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
       with:
         name: preview-instance-url
 
     # If the above fails, try to get the latest pr artifact from the PR related workflows
     - name: Download latest PR artifact
-      uses: dawidd6/action-download-artifact@v6
+      uses: dawidd6/action-download-artifact@0bd50d53a6d7fb5cb921e607957e9cc12b4ce392 # v12
       if: ${{ steps.get-preview-instance-url-artifact.outcome == 'failure' }}
       with:
         name: preview-instance-url
@@ -71,7 +71,7 @@ runs:
         fi
 
     - name: Update status comment
-      uses: actions-cool/maintain-one-comment@v3.1.1
+      uses: actions-cool/maintain-one-comment@4b2dbf086015f892dcb5e8c1106f5fccd6c1476b # v3
       with:
         token: ${{ inputs.github-token }}
         body: |

local/action.yml

@@ -18,14 +18,14 @@ runs:
     - name: Download current workflow's Local State artifact
       id: get-state-artifact
       if: ${{ inputs.action == 'load' }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 #v7
       continue-on-error: true
       with:
         name: ${{ inputs.name }}
 
     # If the above fails, try to get the latest artifact from given workflow
     - name: Download latest Local State artifact
-      uses: dawidd6/action-download-artifact@v6
+      uses: dawidd6/action-download-artifact@0bd50d53a6d7fb5cb921e607957e9cc12b4ce392 #v12
       if: ${{ inputs.action == 'load' && steps.get-state-artifact.outcome == 'failure' }}
       with:
         name: ${{ inputs.name }}
@@ -49,7 +49,7 @@ runs:
         ACTION: "${{ inputs.action }}"
 
     - name: Upload LocalStack State
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
       if: ${{ inputs.action == 'save' }}
       with:
         name: ${{ inputs.name }}

prepare/action.yml

@@ -17,13 +17,13 @@ runs:
       run: echo ${{ github.event.number }} > ./pr-id.txt
 
     - name: Upload PR number
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
       with:
         name: pr-id
         path: ./pr-id.txt
 
     - name: Create initial PR comment
-      uses: actions-cool/maintain-one-comment@v3.1.1
+      uses: actions-cool/maintain-one-comment@4b2dbf086015f892dcb5e8c1106f5fccd6c1476b # v3
       with:
         token: ${{ inputs.github-token }}
         body: |