chore: pin GitHub Actions to commit SHAs

.github/workflows/lighthouse-scan.yml

@@ -53,7 +53,9 @@ jobs:
     outputs:
       lighthouse_result: ${{ steps.audit.outcome }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: write lighthouserc
         run: |
@@ -102,7 +104,7 @@ jobs:
 
       - name: run lighthouse
         id: audit
-        uses: treosh/lighthouse-ci-action@v12
+        uses: treosh/lighthouse-ci-action@3e7e23fb74242897f95c0ba9cabad3d0227b9b18 # 12.6.2
         with:
           urls: ${{ steps.urls.outputs.urls }}
           configPath: .lighthouserc.json

.github/workflows/lint.yml

@@ -36,11 +36,12 @@ jobs:
           fi
 
       - name: Checkout workflow repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: tehw0lf/workflows
           ref: ${{ steps.context.outputs.workflows_ref }}
           path: workflows-repo
+          persist-credentials: false
 
       - name: Generate workflow hash for cache key
         id: workflow-hash

.github/workflows/npm-audit-autofix.yml

@@ -71,14 +71,14 @@ jobs:
           fi
 
       - name: checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.head_ref }}
           token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0
 
       - name: setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: ${{ inputs.node_version }}
           cache: "npm"

.github/workflows/post-publish-verification.yml

@@ -58,7 +58,7 @@ jobs:
       # Authenticate to GHCR for pulling images
       - name: log in to GitHub Container Registry
         if: ${{ inputs.registry == 'ghcr.io' && inputs.docker_meta != '' }}
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -68,7 +68,7 @@ jobs:
       - name: cache trivy installation
         id: cache-trivy
         if: ${{ inputs.docker_meta != '' }}
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             /usr/local/bin/trivy
@@ -134,7 +134,7 @@ jobs:
       # Upload SARIF results to GitHub Security
       - name: upload trivy image SARIF
         if: always() && steps.trivy-image.outcome != 'skipped'
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: trivy-image-*.sarif
           category: trivy-published-images
@@ -143,7 +143,7 @@ jobs:
       # Upload scan reports as artifacts
       - name: upload security scan reports
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: post-publish-verification-reports
           path: trivy-image-*.sarif

.github/workflows/publish-crates-io.yml

@@ -47,10 +47,12 @@ jobs:
       run:
         working-directory: ${{ inputs.root_dir }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: check build artifact existence
-        uses: softwareforgood/check-artifact-v4-existence@v0
+        uses: softwareforgood/check-artifact-v4-existence@f988c59be23773bdf226dffa5720d85a13501fba # v0.4.3
         id: check_artifact_exists
         with:
           name: build
@@ -66,7 +68,7 @@ jobs:
 
       - name: download build artifact
         if: ${{ inputs.artifact_path != '' && steps.check_artifact_exists.outputs.exists == 'true' }}
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: build
           path: ${{ inputs.artifact_path }}
@@ -75,7 +77,7 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
 
       - name: cache cargo dependencies
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -124,7 +126,7 @@ jobs:
       - name: authenticate with crates.io
         if: ${{ steps.version_check.outputs.already_published == 'false' }}
         id: auth
-        uses: rust-lang/crates-io-auth-action@v1
+        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
 
       - name: cargo publish dry-run
         if: ${{ inputs.dry_run == true && steps.version_check.outputs.already_published == 'false' }}

.github/workflows/publish-docker-image.yml

@@ -66,7 +66,9 @@ jobs:
       matrix:
         docker: ${{ fromJson(inputs.docker_meta) }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: validate docker metadata
         if: ${{ inputs.docker_meta != '' }}
@@ -82,14 +84,14 @@ jobs:
         shell: bash
 
       - name: check build artifact existence
-        uses: softwareforgood/check-artifact-v4-existence@v0
+        uses: softwareforgood/check-artifact-v4-existence@f988c59be23773bdf226dffa5720d85a13501fba # v0.4.3
         id: check_artifact_exists
         with:
           name: build
 
       - name: download build artifact
         if: ${{ inputs.artifact_path != '' && steps.check_artifact_exists.outputs.exists == 'true' }}
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: build
           path: ${{ inputs.artifact_path }}
@@ -120,11 +122,11 @@ jobs:
 
       - name: set up docker
         if: ${{ inputs.artifact_path == '' || steps.check_artifact_exists.outputs.exists == 'true' }}
-        uses: docker/setup-buildx-action@v4.1.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: login
         if: ${{ inputs.artifact_path == '' || steps.check_artifact_exists.outputs.exists == 'true' }}
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ inputs.registry }}
           username: ${{ github.actor }}
@@ -140,7 +142,7 @@ jobs:
 
       - name: build and push image
         if: ${{ inputs.artifact_path == '' || steps.check_artifact_exists.outputs.exists == 'true' }}
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: ${{ matrix.docker.file }}

.github/workflows/publish-firefox-extension.yml

@@ -42,14 +42,18 @@ jobs:
       run:
         working-directory: ${{ inputs.root_dir }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: package firefox extension
-        run: zip -r ${{ inputs.xpi_path }} * -x .git\* -x .github\*
+        run: zip -r "$XPI_PATH" * -x .git\* -x .github\*
         shell: bash
+        env:
+          XPI_PATH: ${{ inputs.xpi_path }}
 
       - name: publish firefox extension
-        uses: wdzeng/firefox-addon@v1.2.1
+        uses: wdzeng/firefox-addon@3184ee491b500e080885e046051366a4228c6e5d # v1.2.1
         with:
           addon-guid: ${{ inputs.addon_guid }}
           xpi-path: ${{ inputs.xpi_path }}

.github/workflows/publish-npm-libraries.yml

@@ -52,25 +52,26 @@ jobs:
       run:
         working-directory: ${{ inputs.root_dir }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0
+          persist-credentials: false
 
       - name: check build artifact existence
-        uses: softwareforgood/check-artifact-v4-existence@v0
+        uses: softwareforgood/check-artifact-v4-existence@f988c59be23773bdf226dffa5720d85a13501fba # v0.4.3
         id: check_artifact_exists
         with:
           name: build
 
       - name: download build artifact
         if: ${{ inputs.artifact_path != '' && steps.check_artifact_exists.outputs.exists == 'true' }}
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: build
           path: ${{ inputs.artifact_path }}
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         if: ${{ inputs.tool == 'npm' || inputs.tool == 'yarn' }}
         with:
           node-version: "24.16.0"

.github/workflows/publish-python-libraries.yml

@@ -38,10 +38,12 @@ jobs:
       run:
         working-directory: ${{ inputs.root_dir }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: check build artifact existence
-        uses: softwareforgood/check-artifact-v4-existence@v0
+        uses: softwareforgood/check-artifact-v4-existence@f988c59be23773bdf226dffa5720d85a13501fba # v0.4.3
         id: check_artifact_exists
         with:
           name: build

.github/workflows/release-android-apk.yml

@@ -37,35 +37,35 @@ jobs:
       contents: write
       packages: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: check app artifact existence
-        uses: softwareforgood/check-artifact-v4-existence@v0
+        uses: softwareforgood/check-artifact-v4-existence@f988c59be23773bdf226dffa5720d85a13501fba # v0.4.3
         id: check_app_artifact_exists
         with:
           name: app
 
       - name: download app artifact
         if: ${{ inputs.app_root != '' && steps.check_app_artifact_exists.outputs.exists == 'true' }}
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: app
           path: ${{ inputs.app_root }}
 
       - name: check build artifact existence
-        uses: softwareforgood/check-artifact-v4-existence@v0
+        uses: softwareforgood/check-artifact-v4-existence@f988c59be23773bdf226dffa5720d85a13501fba # v0.4.3
         id: check_build_artifact_exists
         with:
           name: build
 
       - name: download build artifact
         if: ${{ inputs.artifact_path != '' && steps.check_build_artifact_exists.outputs.exists == 'true' }}
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: build
           path: ${{ inputs.artifact_path }}
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         if: ${{ (inputs.tool == 'npm' || inputs.tool == 'yarn') && steps.check_build_artifact_exists.outputs.exists == 'true' && steps.check_app_artifact_exists.outputs.exists == 'true' }}
         with:
           node-version: "24.16.0"
@@ -77,7 +77,7 @@ jobs:
 
       - name: cache keystore
         if: ${{ steps.check_build_artifact_exists.outputs.exists == 'true' && steps.check_app_artifact_exists.outputs.exists == 'true' }}
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: cache
         with:
           path: ${{ inputs.app_root }}/android/app/keystore.jks
@@ -98,14 +98,14 @@ jobs:
 
       - name: set up jdk
         if: ${{ steps.check_build_artifact_exists.outputs.exists == 'true' && steps.check_app_artifact_exists.outputs.exists == 'true' }}
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
         with:
           distribution: "adopt"
           java-version: "24"
 
       - name: set up android sdk
         if: ${{ steps.check_build_artifact_exists.outputs.exists == 'true' && steps.check_app_artifact_exists.outputs.exists == 'true' }}
-        uses: android-actions/setup-android@v4
+        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
         with:
           packages: "build-tools;35.0.0"
 
@@ -169,7 +169,7 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: softprops/action-gh-release@v3
+      - uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         if: ${{ steps.check_build_artifact_exists.outputs.exists == 'true' && steps.check_app_artifact_exists.outputs.exists == 'true' && steps.check_release_exists.outputs.release_exists != 'true' }}
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release-github.yml

@@ -43,17 +43,19 @@ jobs:
         working-directory: ${{ inputs.root_dir }}
     steps:
       - name: checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: check build artifact existence
-        uses: softwareforgood/check-artifact-v4-existence@v0
+        uses: softwareforgood/check-artifact-v4-existence@f988c59be23773bdf226dffa5720d85a13501fba # v0.4.3
         id: check_artifact_exists
         with:
           name: build
 
       - name: download build artifact
         if: ${{ inputs.artifact_path != '' && steps.check_artifact_exists.outputs.exists == 'true' }}
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: build
           path: ${{ inputs.artifact_path }}
@@ -103,7 +105,7 @@ jobs:
         if: ${{ inputs.release_pre != '' && steps.check_artifact_exists.outputs.exists == 'true' && steps.check_release_exists.outputs.release_exists != 'true' }}
         run: ${{ inputs.release_pre }}
 
-      - uses: softprops/action-gh-release@v3
+      - uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         if: ${{ steps.check_artifact_exists.outputs.exists == 'true' && steps.check_release_exists.outputs.release_exists != 'true' }}
         with:
           token: ${{ secrets.GITHUB_TOKEN }}