chore(ci): pin every third-party GitHub Action to a commit SHA

.github/actions/corpora/action.yml

@@ -17,7 +17,7 @@ runs:
   using: composite
   steps:
     - name: Cache the OMG training corpus
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: examples/sysml-v2-training
         key: training-corpus-${{ hashFiles('scripts/download-training-examples.sh', 'scripts/pilot-pin.sh') }}
@@ -39,7 +39,7 @@ runs:
     # Same keying as the training corpus: the download script plus the shared
     # pilot pin.
     - name: Cache the OMG pilot corpora
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: examples/pilot-corpora
         key: pilot-corpora-${{ hashFiles('scripts/download-pilot-corpora.sh', 'scripts/pilot-pin.sh') }}
@@ -64,7 +64,7 @@ runs:
     # the PDFs are cached, the extraction reruns from them (it is the tree's
     # own tool), and the result is verified rather than trusted.
     - name: Cache the OMG specification documents
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: build/spec-docs/pdf
         key: spec-docs-${{ hashFiles('scripts/download-spec-examples.sh', 'scripts/pilot-pin.sh') }}
@@ -89,7 +89,7 @@ runs:
 
     # The PSSM suite is one pinned file; keyed on its download script and pin.
     - name: Cache the OMG PSSM test suite
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: build/pssm
         key: pssm-suite-${{ hashFiles('scripts/download-pssm-suite.sh', 'scripts/pssm-pin.sh') }}
@@ -101,7 +101,7 @@ runs:
     # The SysML v1 to v2 transformation model is one pinned file; keyed on its
     # download script and pin.
     - name: Cache the SysML v1 to v2 transformation model
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: build/sysml-v1tov2
         key: sysml-v1tov2-${{ hashFiles('scripts/download-sysml-v1tov2.sh', 'scripts/sysml-v1tov2-pin.sh') }}
@@ -114,7 +114,7 @@ runs:
     # on its download script and pin. Never run in CI: the Go tests read the
     # committed expected-record (docs/project/fuml-referee.md).
     - name: Cache the fUML reference-implementation suite
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: build/fuml
         key: fuml-suite-${{ hashFiles('scripts/download-fuml-suite.sh', 'scripts/fuml-pin.sh') }}
@@ -126,7 +126,7 @@ runs:
     # The pilot's XMI of the standard library, one subtree of the release
     # repository; keyed on its download script and the shared pilot pin.
     - name: Cache the pilot library XMI
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: build/pilot-library-xmi
         key: pilot-library-xmi-${{ hashFiles('scripts/download-pilot-library-xmi.sh', 'scripts/pilot-pin.sh') }}
@@ -147,7 +147,7 @@ runs:
     # and its pin. A restored cache is verified by the script's own check.
     - name: Cache the Reference-FMUs
       if: inputs.reference-fmus == 'true'
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: examples/reference-fmus
         key: reference-fmus-${{ hashFiles('scripts/download-reference-fmus.sh', 'scripts/reference-fmus-pin.sh') }}

.github/workflows/extension-libraries-upstream.yml

@@ -41,18 +41,18 @@ jobs:
       OPENSYSML_REQUIRE_LLM_BENCH_TOOLCHAIN: "1"
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: true
 
       # Node 24, as the WebAssembly gate pins: Node 22's WASI host crashes on the wasm
       # binaries, and the runner's own Node is older still.
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '24'
 

.github/workflows/oracle-reproduction.yml

@@ -34,15 +34,15 @@ jobs:
     timeout-minutes: 90
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
 
       # The pinned pilot implementation is a Java artifact and the two bridges
       # are plain-Java programs compiled against it.
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
         with:
           distribution: temurin
           java-version: '21'
@@ -117,7 +117,7 @@ jobs:
       # reproducing the environment.
       - name: Upload the fresh reports
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: oracle-reports
           path: |

.github/workflows/pages.yml

@@ -26,13 +26,13 @@ jobs:
       contents: read
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           # Full history: the in-browser engine is stamped by git describe below.
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.12'
           cache: pip
@@ -41,13 +41,13 @@ jobs:
       # The test-suite figures are counted from the tree by tools/cmd/doc-counts as the
       # site is built, so the build needs the Go toolchain.
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: true
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
           cache: npm
@@ -59,7 +59,7 @@ jobs:
         run: make docs-install
 
       - name: Configure GitHub Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
 
       # /cli/ runs the engine in the browser; the same target a local preview uses
       # compiles it into docs/assets (never vendored) for mkdocs to copy into site/.
@@ -73,7 +73,7 @@ jobs:
         run: make docs
 
       - name: Upload GitHub Pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
         with:
           path: site
 
@@ -91,4 +91,4 @@ jobs:
     steps:
       - name: Deploy GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5