Update 3p actions from VID to CSHA (#1205)

This pr updates 3p actions from VID to CSHA for remaining files.

References:
https://github.com/actions/checkout
https://github.com/actions/setup-python
https://github.com/actions/setup-java
https://github.com/actions/setup-node
https://github.com/actions/cache
https://github.com/actions/upload-artifact
https://github.com/actions/setup-node
https://github.com/aws-actions/configure-aws-credentials
https://github.com/actions/download-artifact
https://github.com/aws-actions/aws-secretsmanager-get-secrets
https://github.com/docker/login-action
https://github.com/docker/setup-buildx-action
https://github.com/docker/build-push-action
https://github.com/docker/setup-qemu-action

https://github.com/gradle/actions/blob/f8140229023a7015c7ce4df6f7c390a3cace8f83/docs/deprecation-upgrade-guide.md#using-the-action-to-execute-gradle-via-the-arguments-parameter-is-deprecated
https://github.com/github/codeql-action
https://github.com/hashicorp/setup-terraform
https://github.com/codecov/codecov-action
https://github.com/burrunan/gradle-cache-action
https://github.com/JasonEtco/create-an-issue
https://github.com/benchmark-action/github-action-benchmark

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license.

---------

Co-authored-by: Thomas Pierce <[email protected]>

Author: 2 people

.github/actions/cpUtility-testing/action.yml

@@ -25,28 +25,28 @@ runs:
   using: "composite"
   steps:
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 #3.6.0
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 #v3.11.1
       with:
         driver-opts: image=moby/buildkit:v0.15.1
 
     - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 #v5.0.0
       with:
         role-to-assume: ${{ inputs.snapshot-ecr-role }}
         aws-region: ${{ inputs.aws-region }}
 
     - name: Login to private staging ecr
-      uses: docker/login-action@v3
+      uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 #v3.5.0
       with:
         registry: ${{ inputs.image_registry }}
       env:
         AWS_REGION: ${{ inputs.aws-region }}
 
     - name: Build image for testing
-      uses: docker/build-push-action@v5
+      uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 #v6.18.0
       with:
         push: false
         build-args: "ADOT_JAVA_VERSION=${{ inputs.adot-java-version }}"
@@ -60,7 +60,7 @@ runs:
       run: .github/scripts/test-adot-javaagent-image.sh "${{ inputs.image_uri_with_tag }}" "${{ inputs.adot-java-version }}"
 
     - name: Build and push image
-      uses: docker/build-push-action@v5
+      uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 #v6.18.0
       with:
         push: true
         build-args: "ADOT_JAVA_VERSION=${{ inputs.adot-java-version }}"

.github/actions/image_scan/action.yml

@@ -26,7 +26,7 @@ runs:
       run: docker logout public.ecr.aws
 
     - name: Run Trivy vulnerability scanner on image
-      uses: aquasecurity/trivy-action@master
+      uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 #v0.33.1
       with:
         image-ref: ${{ inputs.image-ref }}
         severity: ${{ inputs.severity }}

.github/actions/patch-dependencies/action.yml

@@ -64,14 +64,14 @@ runs:
       shell: bash
 
     - name: Build opentelemetry-java with tests
-      uses: gradle/gradle-build-action@v2
+      uses: gradle/gradle-build-action@a8f75513eafdebd8141bd1cd4e30fcd194af8dfa #v2
       if: ${{ env.patch_otel_java == 'true' && inputs.run_tests != 'false' }}
       with:
         arguments: build publishToMavenLocal
         build-root-directory: opentelemetry-java
 
     - name: Build opentelemetry-java
-      uses: gradle/gradle-build-action@v2
+      uses: gradle/gradle-build-action@a8f75513eafdebd8141bd1cd4e30fcd194af8dfa #v2
       if: ${{ env.patch_otel_java == 'true' && inputs.run_tests == 'false' }}
       with:
         arguments: publishToMavenLocal
@@ -83,14 +83,14 @@ runs:
       shell: bash
 
     - name: Build opentelemetry-java-contrib with tests
-      uses: gradle/gradle-build-action@v2
+      uses: gradle/gradle-build-action@a8f75513eafdebd8141bd1cd4e30fcd194af8dfa #v2
       if: ${{ env.patch_otel_java_contrib == 'true' && inputs.run_tests != 'false' }}
       with:
         arguments: build publishToMavenLocal
         build-root-directory: opentelemetry-java-contrib
 
     - name: Build opentelemetry-java-contrib
-      uses: gradle/gradle-build-action@v2
+      uses: gradle/gradle-build-action@a8f75513eafdebd8141bd1cd4e30fcd194af8dfa #v2
       if: ${{ env.patch_otel_java_contrib == 'true' && inputs.run_tests == 'false' }}
       with:
         arguments: publishToMavenLocal

.github/workflows/codeql-analysis.yml

@@ -52,11 +52,10 @@ jobs:
 
     - uses: gradle/actions/wrapper-validation@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
 
-    - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a #4.4.3
-      
     - name: Manually build to avoid autobuild failures
-      run: ./gradlew build
+      uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 #v3.5.0
+      with:
+        arguments: build
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@16df4fbc19aea13d921737861d6c622bf3cefe23 #v3.30.3

.github/workflows/daily-scan.yml

@@ -50,11 +50,10 @@ jobs:
       - name: Publish patched dependencies to maven local
         uses: ./.github/actions/patch-dependencies
 
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a #4.4.3
-
       - name: Build JAR
-        run: ./gradlew assemble -PlocalDocker=true
+        uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 #v3.5.0
+        with:
+          arguments: assemble -PlocalDocker=true
 
       # See http://jeremylong.github.io/DependencyCheck/dependency-check-cli/ for installation explanation
       - name: Install and run dependency scan

.github/workflows/docker-build-smoke-tests-fake-backend.yml

@@ -49,8 +49,7 @@ jobs:
         with:
           registry: public.ecr.aws
 
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a #4.4.3
-
       - name: Build and push docker image
-        run: ./gradlew :smoke-tests:fakebackend:jib
+        uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 #v3.5.0
+        with:
+          arguments: :smoke-tests:fakebackend:jib

.github/workflows/e2e-tests-app-with-java-agent.yml

@@ -64,11 +64,10 @@ jobs:
         with:
           registry: public.ecr.aws
 
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a #4.4.3
-      
       - name: Build and push agent and testing docker images with Gradle
-        run: ./gradlew jib
+        uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70
+        with:
+          arguments: jib
         env:
           COMMIT_HASH: ${{ inputs.image_tag }}
 

.github/workflows/e2e-tests-with-operator.yml

@@ -71,7 +71,7 @@ jobs:
           registry: public.ecr.aws
 
       - name: Build and push Sample-Apps without Auto-Instrumentation Agent
-        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a #v4.4.3
+        uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70
 
       - name: Build and push Sample-Apps with Auto-Instrumentation Agent
         run: jibBuildWithoutAgent

.github/workflows/main-build.yml

@@ -89,11 +89,10 @@ jobs:
         with:
           registry: public.ecr.aws
 
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a #4.4.3
-
       - name: Build snapshot with Gradle
-        run: ./gradlew build integrationTests snapshot --stacktrace -PenableCoverage=true -PlocalDocker=true
+        uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 #v3.5.0
+        with:
+          arguments: build integrationTests snapshot --stacktrace -PenableCoverage=true -PlocalDocker=true
         env:
           PUBLISH_TOKEN_USERNAME: ${{ secrets.PUBLISH_TOKEN_USERNAME }}
           PUBLISH_TOKEN_PASSWORD: ${{ secrets.PUBLISH_TOKEN_PASSWORD }}
@@ -222,11 +221,10 @@ jobs:
       - name: Pull base image of Contract Tests Sample Apps
         run: docker pull public.ecr.aws/docker/library/amazoncorretto:23-alpine
 
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a #v4.4.3
-
       - name: Build snapshot with Gradle
-        run: ./gradlew contractTests -PlocalDocker=true
+        uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 #v3.5.0
+        with:
+          arguments: contractTests -PlocalDocker=true
 
   application-signals-lambda-layer-build:
     runs-on: ubuntu-latest

.github/workflows/nightly-upstream-snapshot-build.yml

@@ -23,7 +23,7 @@ jobs:
       image_name: ${{ steps.imageOutput.outputs.imageName }}
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
 
@@ -34,7 +34,7 @@ jobs:
 
         # cache local patch outputs
       - name: Cache local Maven repository
-        uses: actions/cache@v3
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           path: |
             ~/.m2/repository/io/opentelemetry/
@@ -49,18 +49,18 @@ jobs:
       - uses: gradle/actions/wrapper-validation@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 #v5.0.0
         with:
           role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
           aws-region: ${{ env.AWS_DEFAULT_REGION }}
 
       - name: Log in to AWS ECR
-        uses: docker/login-action@v3
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 #v3.5.0
         with:
           registry: public.ecr.aws
 
       - name: Build snapshot with Gradle
-        uses: gradle/gradle-build-action@v3
+        uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 #v3.5.0
         with:
           arguments: build --stacktrace -PenableCoverage=true -PtestUpstreamSnapshots=true
         env:
@@ -95,7 +95,7 @@ jobs:
           snapshot-ecr-role: ${{ secrets.JAVA_INSTRUMENTATION_SNAPSHOT_ECR }}
 
       - name: Upload to GitHub Actions
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
         with:
           name: aws-opentelemetry-agent.jar
           path: otelagent/build/libs/aws-opentelemetry-agent-*.jar
@@ -129,7 +129,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
       - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
@@ -139,21 +139,21 @@ jobs:
       - uses: gradle/actions/wrapper-validation@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 #v5.0.0
         with:
           role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
           aws-region: ${{ env.AWS_DEFAULT_REGION }}
 
       - name: Log in to AWS ECR
-        uses: docker/login-action@v3
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 #v3.5.0
         with:
           registry: public.ecr.aws
 
       - name: Pull base image of Contract Tests Sample Apps
         run: docker pull public.ecr.aws/docker/library/amazoncorretto:23-alpine
 
       - name: Build snapshot with Gradle
-        uses: gradle/gradle-build-action@v3
+        uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 #v3.5.0
         with:
           arguments: contractTests -PtestUpstreamSnapshots=true -PlocalDocker=true