📌 Pin GitHub actions (#1303)

Author: LogFlames

.github/workflows/code-qualitiy.yml

@@ -37,7 +37,7 @@ jobs:
         uses: ./.github/actions/ghasum
 
       - name: Set up JDK 17
-        uses: actions/[email protected]
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
           java-version: '17'
           distribution: 'temurin'
@@ -89,7 +89,7 @@ jobs:
         uses: ./.github/actions/ghasum
 
       - name: Set up JDK 17
-        uses: actions/[email protected]
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
           java-version: '17'
           distribution: 'temurin'

.github/workflows/codeql.yml

@@ -66,14 +66,14 @@ jobs:
         uses: ./.github/actions/ghasum
 
       - name: Set up JDK 17
-        uses: actions/[email protected]
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
           java-version: '17'
           distribution: 'temurin'
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/[email protected]
+        uses: github/codeql-action/init@96f518a34f7a870018057716cc4d7a5c014bd61c # v3.29.10
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -87,6 +87,6 @@ jobs:
         run: mvn -B  clean package
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/[email protected]
+        uses: github/codeql-action/analyze@96f518a34f7a870018057716cc4d7a5c014bd61c # v3.29.10
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/dependency-review.yml

@@ -34,4 +34,4 @@ jobs:
         uses: ./.github/actions/ghasum
 
       - name: Dependency review
-        uses: actions/[email protected]
+        uses: actions/dependency-review-action@bc41886e18ea39df68b1b1245f4184881938e050 # v4.7.2

.github/workflows/doc.yml

@@ -50,6 +50,6 @@ jobs:
 
       - name: Commit changes
         if: steps.check_changes.outputs.changes == 'true'
-        uses: stefanzweifel/[email protected]
+        uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6.0.1
         with:
           commit_message: "📝 Update Documentation with current version"

.github/workflows/gha.sum

@@ -1,16 +1,14 @@
 version 1
 
-actions/cache@v4.2.4 Wn6UGuh8/0fkcOLI8uEQmhssKaMEfnm77brXOpwKe7A=
+actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 Wn6UGuh8/0fkcOLI8uEQmhssKaMEfnm77brXOpwKe7A=
 actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 aYx2ZNrV/U9daVa5XJLnuR3depD7lQqzkyRhH4E9bOU=
-actions/dependency-review-action@v4.7.2 Gd1O6ZG0JtkpyKVsxOwIuNtshdlcYheIADUYdNOIOjo=
-actions/setup-go@v5.5.0 vSiNC7HetrtPF3QhZDzPHWyJ1e8pFltzruLjcw65Sok=
+actions/dependency-review-action@bc41886e18ea39df68b1b1245f4184881938e050 Gd1O6ZG0JtkpyKVsxOwIuNtshdlcYheIADUYdNOIOjo=
+actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 vSiNC7HetrtPF3QhZDzPHWyJ1e8pFltzruLjcw65Sok=
 actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 XE1eqHfEOlHsHx+3cUQA1OGC3jxGBnmx7eTIdEzwSoI=
-actions/setup-java@v4.7.1 cKZQn6p38RgADB4MCMpbFp94sScgm/u3B7rEDB9QS5I=
+actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 cKZQn6p38RgADB4MCMpbFp94sScgm/u3B7rEDB9QS5I=
 actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 kZHHfo2NsxevBRTKrZnUpDu0Cxgtj5Vooe4x4rylvg8=
-actions/[email protected] kZHHfo2NsxevBRTKrZnUpDu0Cxgtj5Vooe4x4rylvg8=
 github/codeql-action@96f518a34f7a870018057716cc4d7a5c014bd61c h0CGAC50uRuMQV8hj6pLuc5zMsaXvXYE/35vEhbnEbs=
-github/[email protected] h0CGAC50uRuMQV8hj6pLuc5zMsaXvXYE/35vEhbnEbs=
-jreleaser/[email protected] Ixc/05XDYYHGUvtC6Jt9gB/mpHPIwBX7PR8At1yEWSs=
+jreleaser/release-action@f69e545b05f149483cecb2fb81866247992694b8 Ixc/05XDYYHGUvtC6Jt9gB/mpHPIwBX7PR8At1yEWSs=
 ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde NlVzVIaycy3fhYp7tgiwvpWvzSsPa48uTVejF6tHEog=
-stefanzweifel/git-auto-commit-action@v6.0.1 5+Y5J+dG+VvtR13IIYuBHcAdJAcnDBQU/U0sRO3YZZw=
+stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 5+Y5J+dG+VvtR13IIYuBHcAdJAcnDBQU/U0sRO3YZZw=
 step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 rG/FhhPP4VlsNB/2lKudn7rieQAYYNLIRb34q19qmFU=

.github/workflows/ghasum.yml

@@ -35,7 +35,7 @@ jobs:
           mode: update
 
       - name: Commit gha.sum
-        uses: stefanzweifel/[email protected]
+        uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6.0.1
         with:
           commit_message: "chore: update ghasum checksums"
           file_pattern: .github/workflows/gha.sum

.github/workflows/jreleaser.yml

@@ -42,7 +42,7 @@ jobs:
         uses: ./.github/actions/ghasum
 
       - name: Set up JDK 17
-        uses: actions/[email protected]
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
           java-version: '17'
           distribution: 'temurin'
@@ -54,7 +54,7 @@ jobs:
           git config --global user.email "<>"
 
       - name: install go
-        uses: actions/[email protected]
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
 
       - name: install semversion
         run: go install github.com/ffurrer2/semver/cmd/semver@latest
@@ -114,7 +114,7 @@ jobs:
         run: mvn help:evaluate -Dexpression=project.version -q -DforceStdout | sed 's/-SNAPSHOT//'
 
       - name: Run JReleaser
-        uses: jreleaser/[email protected]
+        uses: jreleaser/release-action@f69e545b05f149483cecb2fb81866247992694b8 # 2.4.2
         with:
           setup-java: false
           version: 1.18.0
@@ -191,7 +191,7 @@ jobs:
       # Log failure:
       - name: JReleaser release output
         if: always()
-        uses: actions/[email protected]
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: jreleaser-release
           path: |

.github/workflows/smoke-tests.yml

@@ -41,15 +41,15 @@ jobs:
       - name: Verify action checksums
         uses: ./.github/actions/ghasum
 
-      - uses: actions/[email protected]
+      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           path: /root/.jbang
           key: $-jbang-$
           restore-keys: |
               $-jbang-
 
       - name: Set up JDK 17
-        uses: actions/[email protected]
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
           java-version: '17'
           distribution: 'temurin'

renovate.json

@@ -1,6 +1,7 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
+    "helpers:pinGitHubActionDigests",
     "config:recommended"
   ],
   "gitIgnoredAuthors": [