GitHub workflow vulnerabilities fixes - NEXT (#799)

* Update github workflow to use hashes instead of tag

* Added tag version comments alongside with the hashes

* Fix for injection vulnerability in workflows/check-files.yml

* Removed empty spaces

Author: chrngc

.github/actions/checkout-with-stable-pkgs/action.yml

@@ -7,7 +7,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5    #v4
       with:
         fetch-depth: 0
         fetch-tags: true

.github/workflows/check-circular-deps.yml

@@ -21,7 +21,7 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5    #v4
         with:
           persist-credentials: false
 

.github/workflows/check-entangled-specs.yml

@@ -20,13 +20,13 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5    #v4
         with:
           persist-credentials: false
 
       # We use the same major/minor version of Python that Azure Linux ships
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065    #v5
         with:
           python-version: 3.12
 

.github/workflows/check-files.yml

@@ -17,14 +17,16 @@ jobs:
     steps:
 
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5    #v4
 
     - name: Get base commit for PRs
       if: ${{ github.event_name == 'pull_request' }}
       run: |
-        git fetch origin ${{ github.base_ref }}
-        echo "base_sha=$(git rev-parse origin/${{ github.base_ref }})" >> $GITHUB_ENV
-        echo "Merging ${{ github.sha }} into ${{ github.base_ref }}"
+        git fetch origin ${ORIGIN_BASE_REF}
+        echo "base_sha=$(git rev-parse origin/${ORIGIN_BASE_REF})" >> $GITHUB_ENV
+        echo "Merging ${{ github.sha }} into ${ORIGIN_BASE_REF}"
+      env:
+        ORIGIN_BASE_REF: ${{ github.base_ref }}
 
     - name: Get base commit for Pushes
       if: ${{ github.event_name == 'push' }}

.github/workflows/check-license-map.yml

@@ -24,12 +24,12 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5    #v4
         with:
           persist-credentials: false
 
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065    #v5
         with:
           python-version: 3.12
 

.github/workflows/check-manifests.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5    #v4
         with:
           persist-credentials: false
 

.github/workflows/check-package-builds.yml

@@ -119,7 +119,7 @@ jobs:
               sed -i "/^%license/a %doc $license_file_name" "$REGULAR_PKG_SPEC_PATH"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5    #v4
 
       - name: Checkout a stable version of the specs
         uses: ./.github/actions/checkout-with-stable-pkgs

.github/workflows/check-package-cgmanifest.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5    #v4
         with:
           persist-credentials: false
 

.github/workflows/check-source-signatures.yml

@@ -24,14 +24,14 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5    #v4
         with:
           persist-credentials: false
           fetch-depth: 0
 
       # For consistency, we use the same major/minor version of Python that Azure Linux ships
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065    #v5
         with:
           python-version: 3.12
 

.github/workflows/check-spec.yml

@@ -21,14 +21,14 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5    #v4
         with:
           fetch-depth: 0
           persist-credentials: false
 
       # For consistency, we use the same major/minor version of Python that Azure Linux ships
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065    #v5
         with:
           python-version: 3.12
 
@@ -63,7 +63,7 @@ jobs:
           echo "toolchain-spec-list=$(make --no-print-directory -sC toolkit printvar-toolchain_spec_list)" >> "$GITHUB_ENV"
 
       - name: Main branch checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5    #v4
         with:
           ref: '3.0'
           path: '3.0-checkout'