AAE-18225 - Use pinned SHA

.github/actions/automate-dependabot/action.yml

@@ -32,7 +32,7 @@ runs:
     - name: Dependabot metadata
       if: steps.check.outputs.continue == 'true'
       id: metadata
-      uses: dependabot/[email protected]
+      uses: dependabot/fetch-metadata@c9c4182bf1b97f5224aee3906fd373f6b61b4526 # v1.6.0
       with:
         github-token: "${{ inputs.token }}"
 

.github/actions/calculate-next-internal-version/action.yml

@@ -19,8 +19,8 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/setup-python@v4
-    - uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+    - uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
+    - uses: Alfresco/alfresco-build-tools/.github/actions/setup-pysemver@92947f8dee1180182ac6cf516edce1d4eb7d9b38 # v3.9.0
     - id: next-prerelease-resolver
       run: ${{ github.action_path }}/next-prerelease.sh
       shell: bash

.github/actions/dbp-charts/publish-chart/action.yml

@@ -22,11 +22,11 @@ runs:
   using: composite
   steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       with:
         fetch-depth: 0
     - name: Get branch name
-      uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+      uses: Alfresco/alfresco-build-tools/.github/actions/get-branch-name@92947f8dee1180182ac6cf516edce1d4eb7d9b38 # v3.9.0
     - name: Publish
       run: ${{ github.action_path }}/publish_chart.sh
       shell: bash

.github/actions/dbp-charts/verify-compose/action.yml

@@ -22,19 +22,19 @@ runs:
   using: composite
   steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       with:
         fetch-depth: 0
     - if: ${{ inputs.quay_username != '' && inputs.quay_password != '' }}
       name: Login to Quay.io
-      uses: docker/login-action@v3
+      uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
       with:
         registry: quay.io
         username: ${{ inputs.quay_username }}
         password: ${{ inputs.quay_password }}
     - if: ${{ inputs.docker_username != '' && inputs.docker_password != '' }}
       name: Login to Docker Hub
-      uses: docker/login-action@v3
+      uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
       with:
         username: ${{ inputs.docker_username }}
         password: ${{ inputs.docker_password }}

.github/actions/dbp-charts/verify-helm/action.yml

@@ -60,26 +60,26 @@ runs:
   steps:
     - name: Checkout
       if: inputs.skip_checkout == 'false'
-      uses: actions/checkout@v4
+      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       with:
         fetch-depth: 0
-    - uses: aws-actions/configure-aws-credentials@v4
+    - uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
       with:
         aws-region: ${{ inputs.aws_region }}
         aws-access-key-id: ${{ inputs.aws_access_key_id }}
         aws-secret-access-key: ${{ inputs.aws_secret_access_key }}
-    - uses: azure/setup-kubectl@v3
+    - uses: azure/setup-kubectl@901a10e89ea615cf61f57ac05cecdf23e7de06d8 # v3
       with:
         version: ${{ inputs.kubectl_version }}
     - name: Login to Quay.io
-      uses: docker/login-action@v3
+      uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
       with:
         registry: quay.io
         username: ${{ inputs.quay_username }}
         password: ${{ inputs.quay_password }}
       if: ${{ inputs.acs_version != 'community' }}
     - name: Login to Docker Hub
-      uses: docker/login-action@v3
+      uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
       with:
         username: ${{ inputs.docker_username}}
         password: ${{ inputs.docker_password }}

.github/actions/docker-dump-containers-logs/action.yml

@@ -26,7 +26,7 @@ runs:
           echo "artefactName=${{ inputs.output-archive-name }}" >> $GITHUB_ENV
         fi
     - name: "Upload archive containing all *.log files"
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
       with:
         path: logs.tar.gz
         name: ${{ env.artefactName }}

.github/actions/get-build-info/action.yml

@@ -3,7 +3,7 @@ description: "Get build-related info from GitHub and load it as generically name
 runs:
   using: composite
   steps:
-    - uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+    - uses: Alfresco/alfresco-build-tools/.github/actions/get-branch-name@92947f8dee1180182ac6cf516edce1d4eb7d9b38 # v3.9.0
     - name: "Get build info"
       run: |
         [[ $GITHUB_EVENT_NAME == "pull_request" ]] && IS_PULL_REQUEST="true" || IS_PULL_REQUEST="false"

.github/actions/helm-integration-tests/action.yml

@@ -37,7 +37,7 @@ runs:
   using: composite
   steps:
     - name: Setup rancher
-      uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+      uses: Alfresco/alfresco-build-tools/.github/actions/setup-rancher-cli@92947f8dee1180182ac6cf516edce1d4eb7d9b38 # v3.9.0
       with:
         url: ${{ inputs.test-rancher-url }}
         access-key: ${{ inputs.test-rancher-access-key }}

.github/actions/helm-package-chart/action.yml

@@ -42,7 +42,7 @@ runs:
         echo "package-file-path=$PACKAGE_FILE_PATH" >> $GITHUB_OUTPUT
 
     - name: Upload Artifact
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
       with:
         name: ${{steps.package.outputs.package-file}}
         path: ${{steps.package.outputs.package-file-path}}

.github/actions/helm-publish-chart/action.yml

@@ -40,7 +40,7 @@ runs:
       run: echo "CHECKOUT_PATH=$(uuidgen)" >> $GITHUB_ENV
 
     - name: Checkout charts repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       with:
         path: ${{ env.CHECKOUT_PATH }}
         repository: ${{ inputs.helm-charts-repo }}
@@ -110,7 +110,7 @@ runs:
         fi
 
     - name: Commit changes
-      uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+      uses: Alfresco/alfresco-build-tools/.github/actions/git-commit-changes@92947f8dee1180182ac6cf516edce1d4eb7d9b38 # v3.9.0
       with:
         username: ${{ inputs.git-username }}
         add-options: .

.github/actions/helm-release-and-publish/action.yml

@@ -44,21 +44,21 @@ runs:
       run: |
         echo "VERSION=$VERSION" >> $GITHUB_ENV
 
-    - uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+    - uses: Alfresco/alfresco-build-tools/.github/actions/git-check-existing-tag@92947f8dee1180182ac6cf516edce1d4eb7d9b38 # v3.9.0
       id: check-tag
       with:
         tag: ${{ env.VERSION }}
         repository-directory: ${{ inputs.chart-repository-dir }}
 
     - name: Update chart version
       if: steps.check-tag.outputs.exists == 'false'
-      uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+      uses: Alfresco/alfresco-build-tools/.github/actions/helm-update-chart-version@92947f8dee1180182ac6cf516edce1d4eb7d9b38 # v3.9.0
       with:
         new-version: ${{ env.VERSION }}
         chart-repository-dir: ${{ inputs.chart-repository-dir }}
         chart-dir: ${{ inputs.chart-dir }}
 
-    - uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+    - uses: Alfresco/alfresco-build-tools/.github/actions/git-commit-changes@92947f8dee1180182ac6cf516edce1d4eb7d9b38 # v3.9.0
       if: steps.check-tag.outputs.exists == 'false'
       with:
         username: ${{ inputs.git-username }}
@@ -75,7 +75,7 @@ runs:
     - name: Package Helm Chart
       if: steps.check-tag.outputs.exists == 'false'
       id: package-helm-chart
-      uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+      uses: Alfresco/alfresco-build-tools/.github/actions/helm-package-chart@92947f8dee1180182ac6cf516edce1d4eb7d9b38 # v3.9.0
       with:
         chart-dir: ${{ inputs.chart-dir }}
         chart-repository-dir: ${{ inputs.chart-repository-dir }}
@@ -88,7 +88,7 @@ runs:
 
     - name: Publish Helm chart
       if: steps.check-tag.outputs.exists == 'false'
-      uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+      uses: Alfresco/alfresco-build-tools/.github/actions/helm-publish-chart@92947f8dee1180182ac6cf516edce1d4eb7d9b38 # v3.9.0
       with:
         helm-charts-repo: ${{inputs.helm-repository}}
         helm-charts-repo-branch: ${{ inputs.helm-repository-branch }}

.github/actions/helm-update-chart-version/action.yml

@@ -13,7 +13,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+    - uses: Alfresco/alfresco-build-tools/.github/actions/setup-helm-docs@92947f8dee1180182ac6cf516edce1d4eb7d9b38 # v3.9.0
     - name: Update version
       shell: bash
       env:

.github/actions/kubectl-keep-nslogs/action.yml

@@ -34,7 +34,7 @@ runs:
           done
         done
     - name: upload kubernetes logs as artifact
-      uses: actions/[email protected]
+      uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
       with:
         name: >-
           ${{ inputs.namespace }}_logs.${{ github.run_number }}.${{ github.run_attempt }}

.github/actions/maven-build-and-tag/action.yml

@@ -79,17 +79,17 @@ outputs:
 runs:
   using: composite
   steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
-    - uses: actions/cache@v3
+    - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
       with:
         path: ~/.m2/repository
         key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
         restore-keys: |
           ${{ runner.os }}-maven-
 
     - name: Set up JDK
-      uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0
+      uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13
       with:
         java-version: ${{ inputs.java-version }}
         distribution: ${{ inputs.java-distribution }}
@@ -121,7 +121,7 @@ runs:
     - name: Update pom files to the new version
       id: update-pom-to-next-version
       if: github.event_name == 'push' || env.IS_PREVIEW == 'true'
-      uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+      uses: Alfresco/alfresco-build-tools/.github/actions/update-pom-to-next-pre-release@92947f8dee1180182ac6cf516edce1d4eb7d9b38 # v3.9.0
       with:
         property-to-update: ${{ inputs.property-to-update }}
         maven-cli-opts: ${{ steps.compute-maven-options.outputs.result }}
@@ -140,23 +140,23 @@ runs:
 
     - name: Login to DockerHub Registry
       if: inputs.docker-username != '' && (github.event_name == 'push' || env.IS_PREVIEW == 'true')
-      uses: docker/login-action@v3
+      uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
       with:
         registry: docker.io
         username: ${{ inputs.docker-username }}
         password: ${{ inputs.docker-password }}
 
     - name: Login to Quay.io Docker Registry
       if: inputs.quay-username != ''
-      uses: docker/login-action@v3
+      uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
       with:
         registry: quay.io
         username: ${{ inputs.quay-username }}
         password: ${{ inputs.quay-password }}
 
     - name: Login to ghcr.io Docker Registry
       if: inputs.ghcr-username != ''
-      uses: docker/login-action@v3
+      uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
       with:
         registry: ghcr.io
         username: ${{ inputs.ghcr-username }}
@@ -196,15 +196,15 @@ runs:
       run: docker rm -f $(docker ps -a -q)
       continue-on-error: true
 
-    - uses: actions/upload-artifact@v3
+    - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
       if: inputs.upload-jars == 'true'
       with:
         name: ${{ inputs.upload-jars-name }}
         retention-days: 1
         path: |
           ${{ inputs.upload-jars-path }}
 
-    - uses: actions/upload-artifact@v3
+    - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
       if: inputs.upload-coverage == 'true'
       with:
         name: coverage
@@ -216,7 +216,7 @@ runs:
       shell: bash
       run: find . -name TEST-*.xml -exec grep -h testcase {} \; | awk -F '"' '{printf("%s#%s() - %.3fms\n", $4, $2, $6); }' | sort -n -k 3 | tail -20
 
-    - uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+    - uses: Alfresco/alfresco-build-tools/.github/actions/git-commit-changes@92947f8dee1180182ac6cf516edce1d4eb7d9b38 # v3.9.0
       if: github.event_name == 'push'
       with:
         username: ${{ inputs.git-username }}

.github/actions/maven-release/action.yml

@@ -68,22 +68,22 @@ runs:
         echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV
 
     - name: Checkout ${{ inputs.repo }}
-      uses: actions/checkout@v4
+      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       with:
         repository: '${{ inputs.repo }}'
         ref: ${{ inputs.base-ref }}
         path: '${{ env.REPO_DIR }}'
         token: ${{ inputs.github-token }}
 
-    - uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+    - uses: Alfresco/alfresco-build-tools/.github/actions/git-check-existing-tag@92947f8dee1180182ac6cf516edce1d4eb7d9b38 # v3.9.0
       id: check-tag
       with:
         tag: ${{ env.RELEASE_VERSION }}
         repository-directory: ${{ env.REPO_DIR }}
 
     - name: Set up JDK
       if: steps.check-tag.outputs.exists == 'false'
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
       with:
         java-version: ${{ inputs.java-version }}
         distribution: ${{ inputs.java-distribution }}
@@ -147,7 +147,7 @@ runs:
 
     - name: Commit changes
       if: steps.check-tag.outputs.exists == 'false'
-      uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+      uses: Alfresco/alfresco-build-tools/.github/actions/git-commit-changes@92947f8dee1180182ac6cf516edce1d4eb7d9b38 # v3.9.0
       with:
         username: ${{ inputs.git-username }}
         add-options: -u

.github/actions/pre-commit-default/action.yml

@@ -23,7 +23,7 @@ runs:
   using: "composite"
   steps:
     - name: Set up Python ${{ inputs.python-version }}
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
       with:
         python-version: ${{ inputs.python-version }}
     - name: build extra_args
@@ -33,11 +33,11 @@ runs:
       run: |
         EXTRA_ARGS="--all-files ${{ inputs.extra-args }}"
         echo EXTRA_ARGS="${EXTRA_ARGS}" >> $GITHUB_ENV
-    - uses: pre-commit/[email protected]
+    - uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # v3.0.0
       if: inputs.check-format == 'true'
       with:
         extra_args: ${{ env.EXTRA_ARGS }} --config ${{ github.action_path }}/format-config.yaml
-    - uses: pre-commit/[email protected]
+    - uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # v3.0.0
       if: inputs.check-github-configuration == 'true'
       with:
         extra_args: ${{ env.EXTRA_ARGS }} --config ${{ github.action_path }}/github-config.yaml

.github/actions/pre-commit/action.yml

@@ -26,15 +26,15 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       if: inputs.skip_checkout == 'false'
       env:
         REF_TO_CHECKOUT: ${{ inputs.auto-commit == 'true' && github.head_ref || '' }}
       with:
         ref: ${{ env.REF_TO_CHECKOUT }}
 
     - name: Set up Python ${{ inputs.python-version }}
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
       with:
         python-version: ${{ inputs.python-version }}
 

.github/actions/process-coverage-report/action.yml

@@ -54,7 +54,7 @@ outputs:
 runs:
   using: composite
   steps:
-    - uses: madrapps/[email protected]
+    - uses: madrapps/jacoco-report@db72e7e7c96f98d239967958b0a0a6ca7d3bb45f # v1.6.1
       id: jacoco-aggregate
       with:
         paths:  ${{ inputs.paths }}

.github/actions/rancher/action.yml

@@ -28,9 +28,9 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: azure/[email protected]
+    - uses: azure/setup-kubectl@901a10e89ea615cf61f57ac05cecdf23e7de06d8 # v3.2
     - name: setup-python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
       with:
         python-version: "3.9"
         cache: pip

.github/actions/reportportal-prepare/action.yml

@@ -42,7 +42,7 @@ runs:
   using: composite
   steps:
     - name: Get branch name
-      uses: Alfresco/alfresco-build-tools/.github/actions/[email protected]
+      uses: Alfresco/alfresco-build-tools/.github/actions/get-branch-name@92947f8dee1180182ac6cf516edce1d4eb7d9b38 # v3.9.0
 
     - name: Compute Report Portal input info
       id: info