chore(deps): pin dependencies

.github/workflows/auto-comment.yml

@@ -8,7 +8,7 @@ jobs:
     run:
         runs-on: ubuntu-latest
         steps:
-            - uses: wow-actions/auto-comment@v1
+            - uses: wow-actions/auto-comment@2fc064c21cfb2505de3c5c10e1473b8eb7beca1a # v1
               with:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                   pullRequestOpened: |

.github/workflows/build-calm-hub-coverage.yml

@@ -19,18 +19,18 @@ jobs:
         steps:
             # Step 1: Checkout PR Branch
             - name: Checkout PR Branch
-              uses: actions/checkout@v4
+              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
             # Step 2: Set up JDK
             - name: Set up JDK
-              uses: actions/setup-java@v4
+              uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4
               with:
                   distribution: 'temurin'
                   java-version: '21'
 
             # Step 3: Cache Maven Dependencies
             - name: Cache Maven Dependencies
-              uses: actions/cache@v4
+              uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
               with:
                   path: ~/.m2
                   key: ${{ runner.os }}-m2-${{ hashFiles('calm-hub/pom.xml') }}

.github/workflows/build-calm-hub-ui.yml

@@ -18,10 +18,10 @@ jobs:
 
         steps:
             - name: Checkout PR Branch
-              uses: actions/checkout@v4
+              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
             - name: Setup Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
               with:
                   node-version: v22
 

.github/workflows/build-calm-hub.yml

@@ -19,18 +19,18 @@ jobs:
         steps:
             # Step 1: Checkout PR Branch
             - name: Checkout PR Branch
-              uses: actions/checkout@v4
+              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
             # Step 2: Set up JDK
             - name: Set up JDK
-              uses: actions/setup-java@v4
+              uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4
               with:
                   distribution: 'temurin'
                   java-version: '21'
 
             # Step 3: Cache Maven Dependencies
             - name: Cache Maven Dependencies
-              uses: actions/cache@v4
+              uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
               with:
                   path: ~/.m2
                   key: ${{ runner.os }}-m2-${{ hashFiles('calm-hub/pom.xml') }}
@@ -39,7 +39,7 @@ jobs:
 
             # Step 4: Set up Docker (Required for Testcontainers)
             - name: Set up Docker
-              uses: docker/setup-buildx-action@v3
+              uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
 
             # Step 5: Build and Test
             - name: Build and Test

.github/workflows/build-calm-widgets.yml

@@ -18,10 +18,10 @@ jobs:
 
         steps:
             - name: Checkout PR Branch
-              uses: actions/checkout@v4
+              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
             - name: Setup Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
               with:
                   node-version: v22
 

.github/workflows/build-cli.yml

@@ -18,10 +18,10 @@ jobs:
 
         steps:
             - name: Checkout PR Branch
-              uses: actions/checkout@v4
+              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
             - name: Setup Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
               with:
                   node-version: v22
 

.github/workflows/build-docs.yml

@@ -18,10 +18,10 @@ jobs:
 
         steps:
             - name: Checkout PR Branch
-              uses: actions/checkout@v4
+              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
             - name: Setup Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
               with:
                   node-version: v22
                   cache: npm

.github/workflows/build-shared.yml

@@ -18,10 +18,10 @@ jobs:
 
         steps:
             - name: Checkout PR Branch
-              uses: actions/checkout@v4
+              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
             - name: Setup Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
               with:
                   node-version: v22
 

.github/workflows/cve-scanning-maven.yml

@@ -27,10 +27,10 @@ jobs:
                 module-folder: ['calm-hub']
         steps:
             - name: Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
             - name: Setup JDK
-              uses: actions/setup-java@v4
+              uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4
               with:
                   java-version: ${{ matrix.java-version }}
                   cache: maven
@@ -62,7 +62,7 @@ jobs:
 
             - name: Upload Test results
               if: ${{ always() }}
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
               with:
                   name: Depcheck report ${{ github.job }} ${{ matrix.module-folder }}
                   path: ${{ github.workspace }}/${{ matrix.module-folder }}-reports

.github/workflows/cve-scanning-node.yml

@@ -30,9 +30,9 @@ jobs:
                 module-folder: ['cli', 'docs', 'shared']
         steps:
             - name: Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
             - name: Set up Node
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
               with:
                   node-version: 22
             - name: Build project with NPM
@@ -57,7 +57,7 @@ jobs:
               shell: bash
             - name: Upload Test results
               if: ${{ always() }}
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
               with:
                   name: Depcheck report ${{ env.UPNAME }}
                   path: ${{ github.workspace }}/${{ matrix.module-folder }}-reports

.github/workflows/docker-publish-calm-hub.yml

@@ -20,18 +20,18 @@ jobs:
         steps:
             # Step 1: Checkout the repository
             - name: Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
             # Step 2: Set up JDK
             - name: Set up JDK
-              uses: actions/setup-java@v4
+              uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4
               with:
                   distribution: 'temurin'
                   java-version: '21'
 
             # Step 3: Cache Maven Dependencies
             - name: Cache Maven Dependencies
-              uses: actions/cache@v4
+              uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
               with:
                   path: ~/.m2
                   key: ${{ runner.os }}-m2-${{ hashFiles('calm-hub/pom.xml') }}
@@ -45,19 +45,19 @@ jobs:
 
             # Step 5: Set up Docker Buildx for multi-architecture builds
             - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@v3
+              uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
 
             # Step 6: Login to Docker Hub
             - name: Login to Docker Hub
-              uses: docker/login-action@v3
+              uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3
               with:
                   username: ${{ secrets.DOCKER_USERNAME }}
                   password: ${{ secrets.DOCKER_PASSWORD }}
 
             # Step 7: Extract metadata for Docker
             - name: Extract Docker metadata
               id: meta
-              uses: docker/metadata-action@v5
+              uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
               with:
                   images: ${{ secrets.DOCKER_USERNAME }}/calm-hub
                   tags: |
@@ -68,7 +68,7 @@ jobs:
 
             # Step 8: Build and push Docker image
             - name: Build and push
-              uses: docker/build-push-action@v6
+              uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
               with:
                   context: calm-hub
                   file: calm-hub/src/main/docker/Dockerfile.jvm

.github/workflows/license-scanning-maven.yml

@@ -23,9 +23,9 @@ jobs:
                 java-version: ['21']
                 module-folder: ['calm-hub']
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
             - name: Set up JDK
-              uses: actions/setup-java@v4
+              uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4
               with:
                   java-version: ${{ matrix.java-version }}
                   cache: maven
@@ -46,7 +46,7 @@ jobs:
                   if [ $LINES_FOUND -gt 1 ]; then echo $LICENSE_REPORT ; exit -1; fi
               working-directory: ${{ matrix.module-folder }}
             - name: Upload license XML reports
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
               with:
                   name: license-xml-report
                   path: '${{ matrix.module-folder }}/**/${{ env.REPORT_PATH }}'

.github/workflows/license-scanning-node.yml

@@ -20,9 +20,9 @@ jobs:
                 node-version: ['22.x']
                 module-folder: ['cli', 'docs', 'shared']
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
             - name: Use Node.js ${{ matrix.node-version }}
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
               with:
                   node-version: ${{ matrix.node-version }}
             - run: npm install --omit=dev

.github/workflows/pr-labelling.yml

@@ -14,9 +14,9 @@ jobs:
 
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v4
+              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
             - name: Label PR based on changes
-              uses: actions/labeler@v4
+              uses: actions/labeler@ac9175f8a1f3625fd0d4fb234536d26811351594 # v4
               with:
                   repo-token: '${{ secrets.GITHUB_TOKEN }}'

.github/workflows/publish-cli-to-npm.yml

@@ -13,11 +13,11 @@ jobs:
         steps:
             # Checkout the code
             - name: Checkout code
-              uses: actions/checkout@v4
+              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
             # Set up Node.js
             - name: Setup Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
               with:
                   node-version: v22
                   registry-url: 'https://registry.npmjs.org'

.github/workflows/s3-docs-sync.yml

@@ -18,9 +18,9 @@ jobs:
 
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v4
+              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
-            - uses: actions/setup-node@v4
+            - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
               with:
                   node-version: 22
                   cache: npm
@@ -31,7 +31,7 @@ jobs:
               run: npm run build
 
             - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v4
+              uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
               with:
                   aws-access-key-id: ${{ secrets.AWS_S3_ACCESS_KEY }}
                   aws-secret-access-key: ${{ secrets.AWS_S3_SECRET_ACCESS_KEY }}

.github/workflows/s3-sync.yml

@@ -21,9 +21,9 @@ jobs:
 
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v4
+              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
             - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v4
+              uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
               with:
                   aws-access-key-id: ${{ secrets.AWS_S3_ACCESS_KEY }}
                   aws-secret-access-key: ${{ secrets.AWS_S3_SECRET_ACCESS_KEY }}

.github/workflows/s3-video-sync.yml

@@ -17,9 +17,9 @@ jobs:
 
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v4
+              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
             - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v4
+              uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
               with:
                   aws-access-key-id: ${{ secrets.AWS_S3_ACCESS_KEY }}
                   aws-secret-access-key: ${{ secrets.AWS_S3_SECRET_ACCESS_KEY }}

.github/workflows/semgrep-ci.yml

@@ -21,8 +21,8 @@ jobs:
         env:
             SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
         container:
-            image: semgrep/semgrep
+            image: semgrep/semgrep@sha256:7674a72a8bd5beaa4591b728e5950c04c58b27b82803901f36e7f9d70b828906
         if: (github.actor != 'dependabot[bot]')
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
             - run: semgrep ci

.github/workflows/validate-renovate.yml

@@ -20,14 +20,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           # For PRs, this checks out the PR branch/commit
           # For pushes, this checks out the pushed commit
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
           cache: 'npm'

.github/workflows/validate-spectral.yml

@@ -27,10 +27,10 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             # Check out the repository
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
             # Run Spectral
-            - uses: actions/setup-node@v4
+            - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
               with:
                   node-version: v22