Pin dependencies

Author: renovate[bot]

.github/workflows/build.yml

@@ -20,11 +20,11 @@ jobs:
       id-token: write
       contents: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
         with:
-          version: 2025.7.12
-      - uses: SonarSource/ci-github-actions/build-maven@v1
+          version: 2025.12.13
+      - uses: SonarSource/ci-github-actions/build-maven@983645f538ff01044b1e567adb23e6f527d8b52a # 1.8.9
         with:
           deploy-pull-request: true
           artifactory-reader-role: private-reader
@@ -41,9 +41,9 @@ jobs:
       id-token: write
       contents: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
         with:
-          version: 2025.7.12
+          version: 2025.12.13
           cache_save: false
-      - uses: SonarSource/ci-github-actions/promote@v1
+      - uses: SonarSource/ci-github-actions/promote@983645f538ff01044b1e567adb23e6f527d8b52a # 1.8.9

.github/workflows/pr-cleanup.yml

@@ -10,4 +10,4 @@ jobs:
     permissions:
       actions: write
     steps:
-      - uses: SonarSource/ci-github-actions/pr_cleanup@v1
+      - uses: SonarSource/ci-github-actions/pr_cleanup@983645f538ff01044b1e567adb23e6f527d8b52a # 1.8.9

.github/workflows/pre-commit.yml

@@ -8,7 +8,7 @@ jobs:
     name: "pre-commit"
     runs-on: github-ubuntu-latest-s
     steps:
-      - uses: SonarSource/gh-action_pre-commit@0ecedc4e4070444a95f6b6714ddc3ebcdde697c4 # 1.1.0
+      - uses: SonarSource/gh-action_pre-commit@ea734ef4ee748f680f3b4ac268c1ba90e245effc # 1.2.1
         with:
           extra-args: >
             --from-ref=origin/${{ github.event.pull_request.base.ref }}

.github/workflows/releasability.yaml

@@ -20,6 +20,6 @@ jobs:
       contents: read
     if: github.event.workflow_run.conclusion == 'success'
     steps:
-      - uses: SonarSource/gh-action_releasability/releasability-status@v3
+      - uses: SonarSource/gh-action_releasability/releasability-status@760079129287f6a5ae9ffcceecc5d73befdd700c # 3.3.0
         env:
           GITHUB_TOKEN: ${{ github.token }}

.github/workflows/unified-dogfooding.yml

@@ -13,11 +13,11 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
         with:
-          version: 2026.6.1
-      - uses: SonarSource/ci-github-actions/build-maven@v1
+          version: 2026.8.12
+      - uses: SonarSource/ci-github-actions/build-maven@983645f538ff01044b1e567adb23e6f527d8b52a # 1.8.9
         with:
           run-shadow-scans: true
           artifactory-reader-role: private-reader