chore(DATAGO-154079): Pin GitHub Actions to immutable SHA digests

.github/workflows/build-test.yml

@@ -15,7 +15,7 @@ jobs:
       should_skip: ${{ steps.skip_check.outputs.should_skip }}
     steps:
       - id: skip_check
-        uses: fkirc/skip-duplicate-actions@v5.3.1
+        uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf # v5.3.1
         with:
           concurrent_skipping: same_content_newer
           do_not_skip: '["pull_request", "workflow_dispatch", "schedule"]'
@@ -33,11 +33,11 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
       - name: Retrieve secrets from Vault
         id: secrets
-        uses: hashicorp/vault-action@v3
+        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3
         continue-on-error: true
         with:
           url: "${{ secrets.VAULT_ADDR }}"
@@ -51,7 +51,7 @@ jobs:
             secret/data/tools/githubactions RE_BOT_PACKAGES_READ_ONLY_CLASSIC_TOKEN | PACKAGES_ADMIN_TOKEN ;
 
       - name: Setup JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           distribution: zulu
           java-version: 17
@@ -60,15 +60,15 @@ jobs:
         run: mvn clean verify -s maven/settings.xml
       - name: Upload Test Artifacts
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: Test Results
           path: |
             **/target/failsafe-reports/*.xml
             **/target/surefire-reports/*.xml
       - name: Publish Unit Test Results
         if: ${{ !cancelled() && (github.actor != 'dependabot[bot]' || (github.event_name == 'push' && !contains(github.ref, 'dependabot'))) }}
-        uses: EnricoMi/publish-unit-test-result-action@v2
+        uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2
         continue-on-error: true
         with:
           fail_on: nothing

.github/workflows/checkStartSpringIO.yml

@@ -12,10 +12,10 @@ jobs:
     # The type of runner that the job will run on
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
       - name: Query start.spring.io
         id: checkStartSpringIO
-        uses: fjogeleit/http-request-action@v1.11.1
+        uses: fjogeleit/http-request-action@fd5cf60c69049efb1397207cc8b442709a869685 # v1.11.1
         with:
           url: https://start.spring.io/pom.xml?dependencies=solace,cloud-stream
 #          url: https://start.spring.io/pom.xml?bootVersion=3.0.0-SNAPSHOT&dependencies=solace,cloud-stream
@@ -24,7 +24,7 @@ jobs:
           echo ${{ steps.checkStartSpringIO.outputs.response }}
           echo ${{ steps.checkStartSpringIO.outputs.headers }}
       - name: Create Issue Action
-        uses: JasonEtco/create-an-issue@v2.9.1
+        uses: JasonEtco/create-an-issue@e27dddc79c92bc6e4562f268fffa5ed752639abd # v2.9.1
         if: ${{ failure() }} # only run when this job is failed.
         env:
           GITHUB_JOB: ${{ github.job }}

.github/workflows/release.yml

@@ -13,17 +13,17 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           java-version: "17"
           distribution: "zulu"
 
       - name: Retrieve secrets from Vault
         id: secrets
-        uses: hashicorp/vault-action@v3
+        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3
         continue-on-error: true
         with:
           url: "${{ secrets.VAULT_ADDR }}"
@@ -47,7 +47,7 @@ jobs:
           passphrase: ${{ steps.secrets.outputs.MAVEN_GPG_KEY_PASSPHRASE }}
 
       - name: Add SSH Key for write access for commits
-        uses: kielabokkie/ssh-key-and-known-hosts-action@v1
+        uses: kielabokkie/ssh-key-and-known-hosts-action@ff80dac93ba2346f20dbc7f331286c400f0109f7 # v1
         with:
           ssh-private-key: ${{ secrets.COMMIT_KEY }}
           ssh-host: github.com

.github/workflows/snapshot-release.yml

@@ -18,13 +18,13 @@ jobs:
       packages: write
       id-token: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           ref: ${{ github.event.workflow_run.head_branch }}
 
       - name: Retrieve secrets from Vault
         id: secrets
-        uses: hashicorp/vault-action@v3
+        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3
         continue-on-error: true
         with:
           url: "${{ secrets.VAULT_ADDR }}"
@@ -37,7 +37,7 @@ jobs:
             secret/data/tools/githubactions RE_BOT_PACKAGES_READ_ONLY_CLASSIC_USER | PACKAGES_ADMIN_USER ;
             secret/data/tools/githubactions RE_BOT_PACKAGES_READ_ONLY_CLASSIC_TOKEN | PACKAGES_ADMIN_TOKEN ;
 
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           distribution: zulu
           java-version: 17