Additional updates

Author: rlazo

.github/workflows/changelog.yml

@@ -17,7 +17,7 @@ jobs:
       with:
         fetch-depth: 100
         submodules: true
-    - uses: ruby/setup-ruby@v1
+    - uses: ruby/setup-ruby@1a615958ad9d422dd932dc1d5823942ee002799f # v1.227.0
       with:
         ruby-version: '2.7'
     - name: Setup Bundler

.github/workflows/check-vertexai-responses.yml

@@ -17,24 +17,24 @@ jobs:
           echo "latest_tag=$LATEST" >> $GITHUB_ENV
         working-directory: firebase-vertexai/src/test/resources/vertexai-sdk-test-data
       - name: Find comment from previous run if exists
-        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e
+        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0
         id: fc
         with:
           issue-number: ${{github.event.number}}
           body-includes: Vertex AI Mock Responses Check
       - name: Comment on PR if newer version is available
         if: ${{env.cloned_tag != env.latest_tag && !steps.fc.outputs.comment-id}}
-        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
         with:
           issue-number: ${{github.event.number}}
           body: >
             ### Vertex AI Mock Responses Check :warning:
-            
+
             A newer major version of the mock responses for Vertex AI unit tests is available.
             [update_responses.sh](https://github.com/firebase/firebase-android-sdk/blob/main/firebase-vertexai/update_responses.sh)
             should be updated to clone the latest version of the responses: `${{env.latest_tag}}`
       - name: Delete comment when version gets updated
         if: ${{env.cloned_tag == env.latest_tag && steps.fc.outputs.comment-id}}
-        uses: detomarco/delete-comment@850734dd44d8b15fef55b45252613b903ceb06f0
+        uses: detomarco/delete-comment@dd37d1026c669ebfb0ffa5d23890010759ff05d5 # v1.1.0
         with:
           comment-id: ${{ steps.fc.outputs.comment-id }}

.github/workflows/ci_tests.yml

@@ -159,11 +159,11 @@ jobs:
 
     steps:
       - name: Download Artifacts
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e #v4.2.1
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
         with:
           path: artifacts
 
       - name: Publish Test Results
-        uses: EnricoMi/publish-unit-test-result-action@82082dac68ad6a19d980f8ce817e108b9f496c2a
+        uses: EnricoMi/publish-unit-test-result-action@170bf24d20d201b842d7a52403b73ed297e6645b # v2.18.0
         with:
           files: "artifacts/**/*.xml"

.github/workflows/create_releases.yml

@@ -46,7 +46,7 @@ jobs:
           ./gradlew generateReleaseConfig -PcurrentRelease=${{ inputs.name }} -PpastRelease=${{ inputs.past-name }} -PprintOutput=true
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         with:
           base: 'releases/${{ inputs.name }}'
           branch: 'releases/${{ inputs.name }}.release'

.github/workflows/dataconnect.yml

@@ -147,7 +147,7 @@ jobs:
 
       - name: Create AVD
         if: github.event_name == 'schedule' || steps.restore-avd-cache.outputs.cache-hit != 'true'
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@62dbb605bba737720e10b196cb4220d374026a6d #v2.33.0
         with:
           api-level: ${{ env.FDC_ANDROID_EMULATOR_API_LEVEL }}
           arch: x86_64
@@ -187,7 +187,7 @@ jobs:
 
       - name: Gradle connectedCheck
         id: connectedCheck
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@62dbb605bba737720e10b196cb4220d374026a6d #v2.33.0
         # Allow this GitHub Actions "job" to continue even if the tests fail so that logs from a
         # failed test run get uploaded as "artifacts" and are available to investigate failed runs.
         # A later step in this "job" will fail the job if this step fails

.github/workflows/firestore_ci_tests.yml

@@ -72,7 +72,7 @@ jobs:
           credentials_json: ${{ secrets.GCP_SERVICE_ACCOUNT }}
       - uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
       - name: firebase-firestore Integ Tests
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@62dbb605bba737720e10b196cb4220d374026a6d #v2.33.0
         env:
           FIREBASE_CI: 1
           FTL_RESULTS_BUCKET: android-ci
@@ -137,7 +137,7 @@ jobs:
 
       # create composite indexes with Terraform
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v2
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
       - name: Terraform Init
         run: |
           cd firebase-firestore
@@ -164,7 +164,7 @@ jobs:
 
       - name: Firestore Named DB Integ Tests
         timeout-minutes: 20
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@62dbb605bba737720e10b196cb4220d374026a6d #v2.33.0
         env:
           FIREBASE_CI: 1
           FTL_RESULTS_BUCKET: android-ci
@@ -227,7 +227,7 @@ jobs:
       - uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
 
       - name: Firestore Nightly Integ Tests
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@62dbb605bba737720e10b196cb4220d374026a6d #v2.33.0
         env:
           FIREBASE_CI: 1
           FTL_RESULTS_BUCKET: android-ci

.github/workflows/merge-to-main.yml

@@ -15,7 +15,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-    - uses: mshick/add-pr-comment@a65df5f64fc741e91c59b8359a4bc56e57aaf5b1
+    - uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2
       with:
         message: >
           ### 📝 PRs merging into main branch

.github/workflows/plugins-check.yml

@@ -26,7 +26,7 @@ jobs:
         run: |
           ./gradlew plugins:check
       - name: Publish Test Results
-        uses: EnricoMi/publish-unit-test-result-action@82082dac68ad6a19d980f8ce817e108b9f496c2a
+        uses: EnricoMi/publish-unit-test-result-action@170bf24d20d201b842d7a52403b73ed297e6645b # v2.18.0
         with:
           files: "**/build/test-results/**/*.xml"
           check_name: "plugins test results"

.github/workflows/post_release_cleanup.yml

@@ -26,7 +26,7 @@ jobs:
           ./gradlew postReleaseCleanup
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v4
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         with:
           token: ${{ secrets.GOOGLE_OSS_BOT_TOKEN }}
           committer: google-oss-bot <[email protected]>
@@ -41,6 +41,6 @@ jobs:
           title: '${{ inputs.name}} mergeback'
           body: |
             Auto-generated PR for cleaning up release ${{ inputs.name}}
-            
+
             NO_RELEASE_CHANGE
           commit-message: 'Post release cleanup for ${{ inputs.name }}'

.github/workflows/release-note-changes.yml

@@ -54,7 +54,7 @@ jobs:
           fireci changelog_comment -c "${{ steps.changed-files.outputs.all_changed_files }}" -o ./changelog_comment.md
 
       - name: Add PR Comment
-        uses: mshick/[email protected].1
+        uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2
         continue-on-error: true
         with:
           status: ${{ steps.generate-comment.outcome }}