pin actions to sha, use secrets.GITHUB_TOKEN

Author: sidpalas

.github/workflows/04-advanced-features--03-caching.yaml

@@ -52,7 +52,7 @@ jobs:
         working-directory: 04-advanced-features/caching/minimal-node-project
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: actions/setup-node@v4
         with:
           node-version: 20

.github/workflows/04-advanced-features--04-github-permissions.yaml

@@ -40,7 +40,7 @@ jobs:
       pull-requests: read # Can read PR data only
     continue-on-error: true # Avoids failing entire workflow
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Install GitHub CLI
         run: |
@@ -50,11 +50,11 @@ jobs:
       - name: List the first 5 open PRs (allowed)
         run: gh pr list --limit 5
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Attempt to add a label (expected to fail)
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh pr edit 1 --add-label "documentation"
 
@@ -67,7 +67,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Install GitHub CLI
         run: |
@@ -76,10 +76,9 @@ jobs:
 
       - name: Attempt to add a label (expected to succeed)
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh pr edit 1 --add-label "documentation"
-      - name: Confirm the 
-
+      - name: Confirm the
         if: success()
-        run: echo "✅ Write operation succeeded!"
+        run: echo "✅ Write operation succeeded!"

.github/workflows/06-authoring-actions--01-composite-action.yaml

@@ -1,5 +1,4 @@
 name: Composite Action Demo
-
 on:
   workflow_dispatch:
 
@@ -8,7 +7,7 @@ jobs:
     runs-on: ubuntu-24.04
     name: One usage of the composite action
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - id: composite-action-instance
         uses: ./06-authoring-actions/composite-action
         with:
@@ -17,12 +16,11 @@ jobs:
           RANDOM_NUMBER: ${{ steps.composite-action-instance.outputs.random-number }}
         run: echo random-number "$RANDOM_NUMBER"
         shell: bash
-
   hello-world-2:
     runs-on: ubuntu-24.04
     name: Another usage of the composite action
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - id: composite-action-instance
         uses: ./06-authoring-actions/composite-action
         with: