pin all actions to sha with actions-up

Author: sidpalas

.github/workflows/03-core-features--02-step-types.yaml

@@ -18,7 +18,7 @@ jobs:
   say-hello-action:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/hello-world-javascript-action@e76147da8e5c81eaf017dede5645551d4b94427b # v1.2.3
+      - uses: actions/hello-world-javascript-action@081a6d193d1dcb38460df1e6927486d748730f9d # v1.1
         # - uses: actions/hello-world-javascript-action@v1 # This would work, but it would be less stable and less secure:
         with:
           who-to-greet: "from an action in the GitHub Action marketplace! 👋"

.github/workflows/04-advanced-features--02-artifacts.yaml

@@ -13,7 +13,7 @@ jobs:
           echo "Generated by artifact-producer job on $(date)" >> artifact.txt
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: example-artifact
           path: artifact.txt
@@ -24,7 +24,7 @@ jobs:
     needs: artifact-producer
     steps:
       - name: Download artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           name: example-artifact
 

.github/workflows/04-advanced-features--03-caching.yaml

@@ -13,7 +13,7 @@ jobs:
       # Attempt to restore (misses on first run)
       - name: Restore cache
         id: demo-cache
-        uses: actions/cache@v4
+        uses: actions/cache@638ed79f9dc94c1de1baef91bcab5edaa19451f4 # v4.2.4
         with:
           path: demo-cache
           # For info on constructing an appropriate cache key see:
@@ -31,7 +31,7 @@ jobs:
       # Save cache only if we generated new content
       - name: Save cache
         if: steps.demo-cache.outputs.cache-hit != 'true'
-        uses: actions/cache@v4
+        uses: actions/cache@638ed79f9dc94c1de1baef91bcab5edaa19451f4 # v4.2.4
         with:
           path: demo-cache
           key: demo-cache-v1
@@ -52,8 +52,8 @@ jobs:
         working-directory: 04-advanced-features/caching/minimal-node-project
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
+      - uses: actions/setup-node@d7a11313b581b306c961b506cfc8971208bb03f6 # v4.4.0
         with:
           node-version: 20
           cache: npm

.github/workflows/04-advanced-features--04-github-permissions.yaml

@@ -40,7 +40,7 @@ jobs:
       pull-requests: read # Can read PR data only
     continue-on-error: true # Avoids failing entire workflow
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
 
       - name: Install GitHub CLI
         run: |
@@ -67,7 +67,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
 
       - name: Install GitHub CLI
         run: |

.github/workflows/04-advanced-features--05-third-party-auth.yaml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Configure AWS Credentials using static key"
-        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
         with:
           aws-region: us-east-2
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -21,7 +21,7 @@ jobs:
       id-token: write # This is required for requesting the JWT for OIDC auth to AWS
     steps:
       - name: "Configure AWS Credentials - Action for GitHub Actions"
-        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
         with:
           aws-region: us-east-2
           role-to-assume: arn:aws:iam::917774925227:role/github-actions-role

.github/workflows/04-advanced-features--08-workflow-commands.yaml

@@ -9,7 +9,7 @@ jobs:
 
     steps:
       - name: Checkout source code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
 
       - name: Log annotations
         run: |

.github/workflows/06-authoring-actions--01-composite-action.yaml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-24.04
     name: One usage of the composite action
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
       - id: composite-action-instance
         uses: ./06-authoring-actions/composite-action
         with:
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-24.04
     name: Another usage of the composite action
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
       - id: composite-action-instance
         uses: ./06-authoring-actions/composite-action
         with:

.github/workflows/06-authoring-actions--04-javascript-actions.yaml

@@ -8,7 +8,7 @@ jobs:
     name: Javascript action (no build)
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
       - name: Run javascript action
         uses: ./06-authoring-actions/javascript-actions/javascript-action-no-build
         id: hello
@@ -22,7 +22,7 @@ jobs:
     name: Javascript action (with build)
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
         with:
           submodules: true
       - name: Run javascript action
@@ -38,7 +38,7 @@ jobs:
     name: Typescript action
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
         with:
           submodules: true
       - name: Run typescript action

.github/workflows/06-authoring-actions--05-container-actions.yaml

@@ -8,7 +8,7 @@ jobs:
     name: Shell Container Action (dynamic Dockerfile build)
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
         with:
           submodules: true
       - name: Run container action
@@ -24,7 +24,7 @@ jobs:
     name: Shell Container Action (public container image)
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
       - name: Run container action
         uses: ./06-authoring-actions/container-actions/shell-container-action-prebuilt
         id: hello
@@ -38,7 +38,7 @@ jobs:
     name: Python Container Action (dynamic Dockerfile build)
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
       - name: Run container action
         uses: ./06-authoring-actions/container-actions/python-container-action
         id: hello

.github/workflows/09-best-practices--01-cache-benchmark.yaml

@@ -33,7 +33,7 @@ jobs:
           mkdir -p "$ROOT_DIR/$DIR"
 
       - name: Attach nscloud cache volume
-        uses: namespacelabs/nscloud-cache-action@v1
+        uses: namespacelabs/nscloud-cache-action@a289cf5d2fcd6874376aa92f0ef7f99dc923592a # v1.2.17
         with:
           path: ${{ env.ROOT_DIR }}/${{ env.DIR }}
 
@@ -93,7 +93,7 @@ jobs:
           mkdir -p "$ROOT_DIR/$DIR"
 
       - name: Attach nscloud cache volume
-        uses: namespacelabs/nscloud-cache-action@v1
+        uses: namespacelabs/nscloud-cache-action@a289cf5d2fcd6874376aa92f0ef7f99dc923592a # v1.2.17
         with:
           path: ${{ env.ROOT_DIR }}/${{ env.DIR }}
 
@@ -153,7 +153,7 @@ jobs:
 
       - name: Cache directory (ACTIONS)
         id: cache
-        uses: actions/cache@v4
+        uses: actions/cache@638ed79f9dc94c1de1baef91bcab5edaa19451f4 # v4.2.4
         with:
           path: ${{ env.ROOT_DIR }}/${{ env.DIR }}
           key: large-actions-${{ runner.os }}-${{ env.LARGE_SIZE_MB }}mb-${{ env.SALT }}
@@ -201,7 +201,7 @@ jobs:
 
       - name: Cache directory (ACTIONS)
         id: cache
-        uses: actions/cache@v4
+        uses: actions/cache@638ed79f9dc94c1de1baef91bcab5edaa19451f4 # v4.2.4
         with:
           path: ${{ env.ROOT_DIR }}/${{ env.DIR }}
           key: many-actions-${{ runner.os }}-${{ env.SMALL_COUNT }}x${{ env.SMALL_SIZE_BYTES }}-${{ env.SALT }}