From 291fdda9cfda2afd02bad2526b70c142b5b876ec Mon Sep 17 00:00:00 2001
From: Shaojun Liu <61072813+liu-shaojun@users.noreply.github.com>
Date: Sun, 18 Feb 2024 16:49:28 +0800
Subject: [PATCH] Fix: GitHub-owned GitHubAction not pinned by hash (#10152)

---
 .github/workflows/BiWeekly_docker.yml         |   2 +-
 .github/workflows/PR_validation.yml           |  50 +++----
 .github/workflows/bigdl-core-release-pypi.yml |   2 +-
 ...pypi-if-release-more-than-once-per-day.yml |   2 +-
 .../bigdl-llm-stable-release-pypi.yml         |   2 +-
 .github/workflows/bigdl-release-docker.yml    |   2 +-
 .github/workflows/bigdl-release-pypi.yml      |   2 +-
 .github/workflows/bigdl-release-scala.yml     |   2 +-
 .../bigdl-release-tf-math-python-pypi.yml     |   2 +-
 .../chronos-example-python-spark31.yml        |   2 +-
 .../chronos-howto-guides-python-spark31.yml   |   4 +-
 .../workflows/chronos-nb-python-spark31.yml   |  12 +-
 .../chronos-notebook-python-spark31.yml       |   2 +-
 .../workflows/chronos-prvn-python-spark31.yml |   8 +-
 .github/workflows/friesian-docker-build.yml   |   4 +-
 .github/workflows/license-scan.yml            |   4 +-
 .github/workflows/llm-binary-build.yml        |  12 +-
 .github/workflows/llm-harness-evaluation.yml  |   6 +-
 .github/workflows/llm-nightly-test.yml        |   2 +-
 .github/workflows/llm-ppl-evaluation.yml      |   2 +-
 .github/workflows/llm_example_tests.yml       |   2 +-
 .github/workflows/llm_performance_tests.yml   |   8 +-
 .../llm_tests_for_stable_version_on_arc.yml   |   4 +-
 .../llm_tests_for_stable_version_on_spr.yml   |   4 +-
 .github/workflows/llm_unit_tests.yml          |   4 +-
 .github/workflows/mac_nightly_test.yml        |  28 ++--
 .github/workflows/manually_build.yml          |  74 +++++-----
 .../workflows/manually_build_for_testing.yml  |  60 ++++-----
 .github/workflows/nano-nightly-test.yml       |  14 +-
 .github/workflows/nano_howto_guides_tests.yml |   6 +-
 .github/workflows/nano_notebooks_tests.yml    |   6 +-
 .github/workflows/nano_unit_tests_basic.yml   |   2 +-
 .github/workflows/nano_unit_tests_pytorch.yml |   8 +-
 .../workflows/nano_unit_tests_tensorflow.yml  |   4 +-
 .../nightly-build-example-tests-ppml.yaml     |   2 +-
 .github/workflows/nightly_build.yml           |  10 +-
 .github/workflows/nightly_test.yml            | 126 +++++++++---------
 .../workflows/performance-regression-test.yml |   4 +-
 .github/workflows/python-style-check.yml      |   4 +-
 .github/workflows/scala-style-check.yml       |   4 +-
 .github/workflows/sdl_hadolint.yml            |   2 +-
 .github/workflows/sdl_snyk_docker.yml         |   2 +-
 .github/workflows/sdl_snyk_python.yml         |   2 +-
 .github/workflows/sdl_snyk_scala.yml          |   2 +-
 .github/workflows/sdl_virus-malware.yml       |   2 +-
 .github/workflows/url-auto-merge.yml          |   2 +-
 .github/workflows/url_check.yml               |   2 +-
 .github/workflows/weekly_test.yml             |  18 +--
 48 files changed, 265 insertions(+), 265 deletions(-)

diff --git a/.github/workflows/BiWeekly_docker.yml b/.github/workflows/BiWeekly_docker.yml
index 0d5fed76516..7fd6e2ab6f2 100644
--- a/.github/workflows/BiWeekly_docker.yml
+++ b/.github/workflows/BiWeekly_docker.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
diff --git a/.github/workflows/PR_validation.yml b/.github/workflows/PR_validation.yml
index 83501408304..f509fa1b76c 100644
--- a/.github/workflows/PR_validation.yml
+++ b/.github/workflows/PR_validation.yml
@@ -72,7 +72,7 @@ jobs:
       orca-example: ${{ steps.filter.outputs.orca-example }}
       ppml: ${{ steps.filter.outputs.ppml }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - uses: dorny/paths-filter@v2
         id: filter
         with:
@@ -168,7 +168,7 @@ jobs:
     runs-on: [ self-hosted, ubuntu-20.04-lts, CLX, AVX512, Ettenmoors ]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: Set up JDK8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up maven
@@ -182,7 +182,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: Set up JDK8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up maven
@@ -196,7 +196,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: Set up JDK8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up maven
@@ -210,7 +210,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
         
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: Set up JDK8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up maven
@@ -229,7 +229,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -248,7 +248,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -267,7 +267,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -286,7 +286,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -305,7 +305,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -324,7 +324,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -343,7 +343,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -362,7 +362,7 @@ jobs:
     runs-on: [self-hosted, Gondolin-Ctx]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Setup env
       uses: ./.github/actions/orca/setup-env/setup-orca-ray-ctx-py37
     - name: Run Test
@@ -377,7 +377,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -396,7 +396,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: Set up JDK8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up maven
@@ -415,7 +415,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: Set up JDK8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up maven
@@ -434,7 +434,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -453,7 +453,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -472,7 +472,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -491,7 +491,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -510,7 +510,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -529,7 +529,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -548,7 +548,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -567,7 +567,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -586,7 +586,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
diff --git a/.github/workflows/bigdl-core-release-pypi.yml b/.github/workflows/bigdl-core-release-pypi.yml
index 294cd9a49e9..6122f9b3db5 100644
--- a/.github/workflows/bigdl-core-release-pypi.yml
+++ b/.github/workflows/bigdl-core-release-pypi.yml
@@ -34,7 +34,7 @@ jobs:
     runs-on: [self-hosted, ubuntu-20.04-lts, Bree-core]
     needs: llm-cpp-build
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         repository: intel-analytics/BigDL-core
         ref: ${{ env.Branch }}
diff --git a/.github/workflows/bigdl-deploy-pypi-if-release-more-than-once-per-day.yml b/.github/workflows/bigdl-deploy-pypi-if-release-more-than-once-per-day.yml
index c382b77b63c..670ccb267cb 100644
--- a/.github/workflows/bigdl-deploy-pypi-if-release-more-than-once-per-day.yml
+++ b/.github/workflows/bigdl-deploy-pypi-if-release-more-than-once-per-day.yml
@@ -23,7 +23,7 @@ jobs:
     # if: ${{ github.actor == 'Le-Zheng' }}
     needs: llm-cpp-build
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
 
diff --git a/.github/workflows/bigdl-llm-stable-release-pypi.yml b/.github/workflows/bigdl-llm-stable-release-pypi.yml
index 6735c39f163..fbd7ad8d6b2 100644
--- a/.github/workflows/bigdl-llm-stable-release-pypi.yml
+++ b/.github/workflows/bigdl-llm-stable-release-pypi.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: [self-hosted, ubuntu-20.04-lts, Bree]
     needs: llm-cpp-build
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: set stable version
       env:
         DEFAULT_VERSION: '2.5.0b0'
diff --git a/.github/workflows/bigdl-release-docker.yml b/.github/workflows/bigdl-release-docker.yml
index c0c6fb2282b..4aeac805f48 100644
--- a/.github/workflows/bigdl-release-docker.yml
+++ b/.github/workflows/bigdl-release-docker.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: set env
       env:
         DEFAULT_TAG: 'latest'
diff --git a/.github/workflows/bigdl-release-pypi.yml b/.github/workflows/bigdl-release-pypi.yml
index 3f19fe58ecd..06508337ba5 100644
--- a/.github/workflows/bigdl-release-pypi.yml
+++ b/.github/workflows/bigdl-release-pypi.yml
@@ -16,7 +16,7 @@ jobs:
     # if: ${{ github.actor == 'Le-Zheng' }}
     needs: llm-cpp-build
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
 
diff --git a/.github/workflows/bigdl-release-scala.yml b/.github/workflows/bigdl-release-scala.yml
index 9cff5c1b894..617d3524bbb 100644
--- a/.github/workflows/bigdl-release-scala.yml
+++ b/.github/workflows/bigdl-release-scala.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: [self-hosted, Bree]
     # if: ${{ github.actor == 'Le-Zheng' }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up Maven
diff --git a/.github/workflows/bigdl-release-tf-math-python-pypi.yml b/.github/workflows/bigdl-release-tf-math-python-pypi.yml
index 0d33f13f5aa..b48550fea83 100644
--- a/.github/workflows/bigdl-release-tf-math-python-pypi.yml
+++ b/.github/workflows/bigdl-release-tf-math-python-pypi.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: [self-hosted, ubuntu-20.04-lts, Bree-core]
     
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
 
diff --git a/.github/workflows/chronos-example-python-spark31.yml b/.github/workflows/chronos-example-python-spark31.yml
index 9be152864eb..32896ff2050 100644
--- a/.github/workflows/chronos-example-python-spark31.yml
+++ b/.github/workflows/chronos-example-python-spark31.yml
@@ -35,7 +35,7 @@ jobs:
       matrix:
         python-version: ["3.8", "3.9"]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up JDK 8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up Maven
diff --git a/.github/workflows/chronos-howto-guides-python-spark31.yml b/.github/workflows/chronos-howto-guides-python-spark31.yml
index 9ecd1c0c301..89f5c77bba4 100644
--- a/.github/workflows/chronos-howto-guides-python-spark31.yml
+++ b/.github/workflows/chronos-howto-guides-python-spark31.yml
@@ -29,7 +29,7 @@ jobs:
       matrix:
         python-version: ["3.8", "3.9"]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up JDK 8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up Maven
@@ -84,7 +84,7 @@ jobs:
       matrix:
         python-version: ["3.8", "3.9"]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up JDK 8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up Maven
diff --git a/.github/workflows/chronos-nb-python-spark31.yml b/.github/workflows/chronos-nb-python-spark31.yml
index 7e72d098144..61ed25e100a 100644
--- a/.github/workflows/chronos-nb-python-spark31.yml
+++ b/.github/workflows/chronos-nb-python-spark31.yml
@@ -26,7 +26,7 @@ jobs:
       matrix:
         python-version: ["3.8", "3.9"]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up JDK 8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up Maven
@@ -82,7 +82,7 @@ jobs:
       matrix:
         python-version: ["3.8", "3.9"]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up JDK 8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up Maven
@@ -137,7 +137,7 @@ jobs:
       matrix:
         python-version: ["3.8", "3.9"]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up JDK 8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up Maven
@@ -192,7 +192,7 @@ jobs:
       matrix:
         python-version: ["3.8", "3.9"]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up JDK 8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up Maven
@@ -250,7 +250,7 @@ jobs:
       matrix:
         python-version: ["3.8", "3.9"]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up JDK 8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up Maven
@@ -303,7 +303,7 @@ jobs:
   create-workflow-badge:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: create workflow badge
       if: ${{ always() }}
       uses: ./.github/actions/create-job-status-badge
diff --git a/.github/workflows/chronos-notebook-python-spark31.yml b/.github/workflows/chronos-notebook-python-spark31.yml
index d32e9610504..5010c1cce80 100644
--- a/.github/workflows/chronos-notebook-python-spark31.yml
+++ b/.github/workflows/chronos-notebook-python-spark31.yml
@@ -29,7 +29,7 @@ jobs:
       matrix:
         python-version: ["3.8", "3.9"]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up JDK 8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up Maven
diff --git a/.github/workflows/chronos-prvn-python-spark31.yml b/.github/workflows/chronos-prvn-python-spark31.yml
index 1aa757b6b25..47676fe627f 100644
--- a/.github/workflows/chronos-prvn-python-spark31.yml
+++ b/.github/workflows/chronos-prvn-python-spark31.yml
@@ -37,7 +37,7 @@ jobs:
       matrix:
         python-version: ["3.8", "3.9"]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up JDK 8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up Maven
@@ -91,7 +91,7 @@ jobs:
       matrix:
         python-version: ["3.8", "3.9"]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up JDK 8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up Maven
@@ -145,7 +145,7 @@ jobs:
       matrix:
         python-version: ["3.8", "3.9"]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up JDK 8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up Maven
@@ -199,7 +199,7 @@ jobs:
       matrix:
         python-version: ["3.8", "3.9"]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up JDK 8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up Maven
diff --git a/.github/workflows/friesian-docker-build.yml b/.github/workflows/friesian-docker-build.yml
index c434b7f4bab..1a0288bee5b 100644
--- a/.github/workflows/friesian-docker-build.yml
+++ b/.github/workflows/friesian-docker-build.yml
@@ -38,7 +38,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'serving-jar-package' || github.event.inputs.artifact == 'all' }}
     runs-on:  [self-hosted,alpha,Bree,ubuntu-20.04-lts]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
 
       - name: Set up JDK8
         uses: ./.github/actions/jdk-setup-action
@@ -63,7 +63,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'docker-build' || github.event.inputs.artifact == 'all' }}
     runs-on: [ self-hosted, Shire ]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: set env
         run: |
           echo "TAG=${{github.event.inputs.tag||'latest'}}" >> $GITHUB_ENV
diff --git a/.github/workflows/license-scan.yml b/.github/workflows/license-scan.yml
index e62f64ae228..d6ee50317fd 100644
--- a/.github/workflows/license-scan.yml
+++ b/.github/workflows/license-scan.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: [self-hosted, Linux, Bree]
     steps:
     - name: "Checkout Code"
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
 
     - name: "Run FOSSA Scan"
       uses: fossas/fossa-action@main # Use a specific version if locking is preferred
@@ -84,7 +84,7 @@ jobs:
   create-workflow-badge:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: create workflow badge
       if: ${{ always() }}
       uses: ./.github/actions/create-job-status-badge
diff --git a/.github/workflows/llm-binary-build.yml b/.github/workflows/llm-binary-build.yml
index c1898f7f621..6410bb5bd54 100644
--- a/.github/workflows/llm-binary-build.yml
+++ b/.github/workflows/llm-binary-build.yml
@@ -67,7 +67,7 @@ jobs:
           conda create -n python310 python=3.10 -y
           conda remove -n python311 --all -y
           conda create -n python311 python=3.11 -y
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
         with:
           repository: "intel-analytics/llm.cpp"
           ref: ${{ inputs.llmcpp-ref }}
@@ -175,7 +175,7 @@ jobs:
           yum install -y gcc-toolset-11 cmake git
           conda remove -n python39 --all -y
           conda create -n python39 python=3.9 -y
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
         with:
           repository: "intel-analytics/llm.cpp"
           ref: ${{ inputs.llmcpp-ref }}
@@ -275,7 +275,7 @@ jobs:
           yum install -y gcc-toolset-11 cmake git
           conda remove -n python39 --all -y
           conda create -n python39 python=3.9 -y
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
         with:
           repository: "intel-analytics/llm.cpp"
           ref: ${{ inputs.llmcpp-ref }}
@@ -338,7 +338,7 @@ jobs:
         run: |
           echo "github_access_token=$env:GITHUB_ACCESS_TOKEN" >> $env:GITHUB_ENV
           echo "github_access_token=$env:GITHUB_ACCESS_TOKEN"
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
         with:
           repository: "intel-analytics/llm.cpp"
           ref: ${{ inputs.llmcpp-ref }}
@@ -386,7 +386,7 @@ jobs:
         run: |
           echo "github_access_token=$env:GITHUB_ACCESS_TOKEN" >> $env:GITHUB_ENV
           echo "github_access_token=$env:GITHUB_ACCESS_TOKEN"
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
         with:
           repository: "intel-analytics/llm.cpp"
           ref: ${{ inputs.llmcpp-ref }}
@@ -491,7 +491,7 @@ jobs:
         run: |
           echo "github_access_token=$env:GITHUB_ACCESS_TOKEN" >> $env:GITHUB_ENV
           echo "github_access_token=$env:GITHUB_ACCESS_TOKEN"
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
         with:
           repository: "intel-analytics/llm.cpp"
           ref: ${{ inputs.llmcpp-ref }}
diff --git a/.github/workflows/llm-harness-evaluation.yml b/.github/workflows/llm-harness-evaluation.yml
index 984e809fe22..4c201711231 100644
--- a/.github/workflows/llm-harness-evaluation.yml
+++ b/.github/workflows/llm-harness-evaluation.yml
@@ -117,7 +117,7 @@ jobs:
       ORIGIN_DIR: /mnt/disk1/models
       HARNESS_HF_HOME: /mnt/disk1/harness_home
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v4
         with:
@@ -204,7 +204,7 @@ jobs:
     needs: llm-harness-evalution
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: Set up Python 3.9
         uses: actions/setup-python@v4
         with:
@@ -231,7 +231,7 @@ jobs:
     needs: [set-matrix, llm-harness-evalution]
     runs-on: ["self-hosted", "llm", "accuracy1", "accuracy-nightly"]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: Set up Python 3.9
         uses: actions/setup-python@v4
         with:
diff --git a/.github/workflows/llm-nightly-test.yml b/.github/workflows/llm-nightly-test.yml
index 8c70980584c..2dc69fdcc92 100644
--- a/.github/workflows/llm-nightly-test.yml
+++ b/.github/workflows/llm-nightly-test.yml
@@ -68,7 +68,7 @@ jobs:
           echo "GPTNEOX_INT4_CKPT_PATH=${INT4_CKPT_DIR}/bigdl_llm_gptneox_q4_0.bin" >> "$GITHUB_ENV"
           echo "BLOOM_INT4_CKPT_PATH=${INT4_CKPT_DIR}/bigdl_llm_bloom_q4_0.bin" >> "$GITHUB_ENV"
           echo "STARCODER_INT4_CKPT_PATH=${INT4_CKPT_DIR}/bigdl_llm_starcoder_q4_0.bin" >> "$GITHUB_ENV"
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v4
         with:
diff --git a/.github/workflows/llm-ppl-evaluation.yml b/.github/workflows/llm-ppl-evaluation.yml
index 13f02339ecf..3a18ddfd92b 100644
--- a/.github/workflows/llm-ppl-evaluation.yml
+++ b/.github/workflows/llm-ppl-evaluation.yml
@@ -150,7 +150,7 @@ jobs:
       ORIGIN_DIR: /mnt/disk1/models
       DATASET_DIR: /mnt/disk1/datasets/THUDM___long_bench/
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v4
         with:
diff --git a/.github/workflows/llm_example_tests.yml b/.github/workflows/llm_example_tests.yml
index 23d9a876d0e..8338e48a2fb 100644
--- a/.github/workflows/llm_example_tests.yml
+++ b/.github/workflows/llm_example_tests.yml
@@ -45,7 +45,7 @@ jobs:
     env:
       THREAD_NUM: 24
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v2
         with:
diff --git a/.github/workflows/llm_performance_tests.yml b/.github/workflows/llm_performance_tests.yml
index ce88197265b..f2cae0923fa 100644
--- a/.github/workflows/llm_performance_tests.yml
+++ b/.github/workflows/llm_performance_tests.yml
@@ -42,7 +42,7 @@ jobs:
       CSV_SAVE_PATH: ${{ github.event.schedule && '/mnt/disk1/nightly_perf_gpu/' || '/mnt/disk1/pr_perf_gpu/' }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v4
@@ -156,7 +156,7 @@ jobs:
       THREAD_NUM: 16
       ANALYTICS_ZOO_ROOT: ${{ github.workspace }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v4
@@ -225,7 +225,7 @@ jobs:
       ANALYTICS_ZOO_ROOT: ${{ github.workspace }}
       CSV_SAVE_PATH: ${{ github.event.schedule && 'D:/action-runners/nightly_perf_core_' || 'D:/action-runners/pr_perf_core_' }}${{ matrix.platform }}/
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v4
@@ -292,7 +292,7 @@ jobs:
     env:
       ANALYTICS_ZOO_ROOT: ${{ github.workspace }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
 
       # TODO: Put the bigdl-llm related install process for win gpu into a action function
 
diff --git a/.github/workflows/llm_tests_for_stable_version_on_arc.yml b/.github/workflows/llm_tests_for_stable_version_on_arc.yml
index 0c11de9f887..868893de911 100644
--- a/.github/workflows/llm_tests_for_stable_version_on_arc.yml
+++ b/.github/workflows/llm_tests_for_stable_version_on_arc.yml
@@ -38,7 +38,7 @@ jobs:
       CSV_SAVE_PATH: '/mnt/disk1/stable_version_perf_gpu/'
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v4
@@ -160,7 +160,7 @@ jobs:
       CSV_SAVE_PATH: '/mnt/disk1/stable_version_stress_test_gpu/'
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v4
diff --git a/.github/workflows/llm_tests_for_stable_version_on_spr.yml b/.github/workflows/llm_tests_for_stable_version_on_spr.yml
index f7df9b4287c..9a23359d022 100644
--- a/.github/workflows/llm_tests_for_stable_version_on_spr.yml
+++ b/.github/workflows/llm_tests_for_stable_version_on_spr.yml
@@ -36,7 +36,7 @@ jobs:
       THREAD_NUM: 16
       ANALYTICS_ZOO_ROOT: ${{ github.workspace }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v4
@@ -94,7 +94,7 @@ jobs:
       THREAD_NUM: 16
       ANALYTICS_ZOO_ROOT: ${{ github.workspace }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v4
diff --git a/.github/workflows/llm_unit_tests.yml b/.github/workflows/llm_unit_tests.yml
index 7924fda638a..674268c56fc 100644
--- a/.github/workflows/llm_unit_tests.yml
+++ b/.github/workflows/llm_unit_tests.yml
@@ -108,7 +108,7 @@ jobs:
           echo "BLOOM_INT4_CKPT_PATH=${INT4_CKPT_DIR}/bigdl_llm_bloom_7b_q4_0.bin" >> "$GITHUB_ENV"
           echo "STARCODER_INT4_CKPT_PATH=${INT4_CKPT_DIR}/bigdl_llm_santacoder_1b_q4_0.bin" >> "$GITHUB_ENV"
           echo "CHATGLM_INT4_CKPT_PATH=${INT4_CKPT_DIR}/chatglm2-6b-q4_0.bin" >> "$GITHUB_ENV"
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v4
         with:
@@ -236,7 +236,7 @@ jobs:
           echo "WHISPER_TINY_ORIGIN_PATH=${ORIGIN_DIR}/whisper-tiny" >> "$GITHUB_ENV"
 
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v4
diff --git a/.github/workflows/mac_nightly_test.yml b/.github/workflows/mac_nightly_test.yml
index 4d1afb94c05..f179cbd216e 100644
--- a/.github/workflows/mac_nightly_test.yml
+++ b/.github/workflows/mac_nightly_test.yml
@@ -43,7 +43,7 @@ jobs:
     runs-on: [self-hosted, mac, macOS]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Run Test
       uses: ./.github/actions/mac/app/mac-python-apptest-part1
     - name: Create Job Badge
@@ -64,7 +64,7 @@ jobs:
     runs-on: [self-hosted, mac, macOS]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Run Test
       uses: ./.github/actions/mac/dllib/mac-dllib-scalatest-spark3
     - name: Create Job Badge
@@ -84,7 +84,7 @@ jobs:
     runs-on: [self-hosted, mac, macOS]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Run Test
       uses: ./.github/actions/mac/dllib/mac-dllib-python-exampletest-spark3
     - name: Create Job Badge
@@ -104,7 +104,7 @@ jobs:
     runs-on: [self-hosted, mac, macOS]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Run Test
       uses: ./.github/actions/mac/friesian/mac-friesian-python-ut-spark3
     - name: Create Job Badge
@@ -124,7 +124,7 @@ jobs:
     runs-on: [self-hosted, mac, macOS]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Run Test
       uses: ./.github/actions/mac/friesian/mac-friesian-python-ut-pip-spark3
     - name: Create Job Badge
@@ -144,7 +144,7 @@ jobs:
     runs-on: [self-hosted, mac, macOS]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Run Test
       uses: ./.github/actions/mac/friesian/mac-friesian-python-exampletest-tf2-spark3
     - name: Create Job Badge
@@ -164,7 +164,7 @@ jobs:
     runs-on: [self-hosted, mac, macOS]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Run Test
       uses: ./.github/actions/mac/friesian/mac-friesian-python-exampletest-tf2-pip-spark3
     - name: Create Job Badge
@@ -184,7 +184,7 @@ jobs:
     runs-on: [self-hosted, mac, macOS]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Run Test
       uses: ./.github/actions/mac/friesian/mac-friesian-python-exampletest-feature-tf1-spark3
     - name: Create Job Badge
@@ -204,7 +204,7 @@ jobs:
     runs-on: [self-hosted, mac, macOS]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Run Test
       uses: ./.github/actions/mac/friesian/mac-friesian-python-exampletest-feature-tf1-pip-spark3
     - name: Create Job Badge
@@ -224,7 +224,7 @@ jobs:
     runs-on: [self-hosted, mac, macOS]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Run Test
       uses: ./.github/actions/mac/orca/mac-orca-python-ut-spark3
     - name: Create Job Badge
@@ -244,7 +244,7 @@ jobs:
     runs-on: [self-hosted, mac, macOS]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Run Test
       uses: ./.github/actions/mac/orca/mac-orca-python-ut-ray-spark3
     - name: Create Job Badge
@@ -264,7 +264,7 @@ jobs:
     runs-on: [self-hosted, mac, macOS]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Run Test
       uses: ./.github/actions/mac/orca/mac-orca-python-exampletest-spark3
     - name: Create Job Badge
@@ -284,7 +284,7 @@ jobs:
     runs-on: [self-hosted, mac, macOS]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Run Test
       uses: ./.github/actions/mac/orca/mac-orca-python-exampletest-ray-spark3
     - name: Create Job Badge
@@ -303,7 +303,7 @@ jobs:
   create-workflow-badge:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: create workflow badge
       if: ${{ always() }}
       uses: ./.github/actions/create-job-status-badge
diff --git a/.github/workflows/manually_build.yml b/.github/workflows/manually_build.yml
index 8f9955ff8e2..62da575f4b8 100644
--- a/.github/workflows/manually_build.yml
+++ b/.github/workflows/manually_build.yml
@@ -65,7 +65,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -92,7 +92,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: docker login
         run: |
           docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -119,7 +119,7 @@ jobs:
     runs-on: [self-hosted, Shire]
     
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -146,7 +146,7 @@ jobs:
     runs-on: [self-hosted, Shire]
     
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -173,7 +173,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -200,7 +200,7 @@ jobs:
     runs-on: [self-hosted, Shire]
     
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -226,7 +226,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-llm-serving-cpu' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -253,7 +253,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -280,7 +280,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-bigdl-llm-gramine-base' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -310,7 +310,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-bigdl-llm-gramine-ref' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -341,7 +341,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-deep-learning-gramine-base' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -372,7 +372,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-deep-learning-gramine-ref' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -404,7 +404,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-dl-serving-gramine-base' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -432,7 +432,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-dl-serving-gramine-ref' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -464,7 +464,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -605,7 +605,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -728,7 +728,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -762,7 +762,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: docker login
         run: |
           docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -796,7 +796,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -831,7 +831,7 @@ jobs:
     runs-on: [ self-hosted, Shire ]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: docker login
         run: |
           docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -877,7 +877,7 @@ jobs:
     runs-on: [ self-hosted, Shire ]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: docker login
         run: |
           docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -916,7 +916,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -950,7 +950,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-bigdl-llm-serving-tdx' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -981,7 +981,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-bigdl-llm-tdx' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -1008,7 +1008,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -1043,7 +1043,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker deploy kms-util
       run: |
         export IMAGE=intelanalytics/kms-utils
@@ -1068,7 +1068,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -1116,7 +1116,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker deploy pccs
       run: |
         export IMAGE=intelanalytics/pccs
@@ -1138,7 +1138,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-python-toolkit-base' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -1166,7 +1166,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-python-toolkit-ref' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -1200,7 +1200,7 @@ jobs:
     runs-on: [self-hosted, Shire]
     
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -1382,7 +1382,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-machine-learning-base' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -1420,7 +1420,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-machine-learning-ref' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -1558,7 +1558,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-kms-base' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -1587,7 +1587,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-kms-reference' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -1618,7 +1618,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
@@ -1645,7 +1645,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: docker login
       run: |
         docker login -u ${DOCKERHUB_USERNAME} -p ${DOCKERHUB_PASSWORD}
diff --git a/.github/workflows/manually_build_for_testing.yml b/.github/workflows/manually_build_for_testing.yml
index 3af4bc9a7fe..6a5f34a2946 100644
--- a/.github/workflows/manually_build_for_testing.yml
+++ b/.github/workflows/manually_build_for_testing.yml
@@ -62,7 +62,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -91,7 +91,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
         with:
           ref: ${{ github.event.inputs.sha }}
       - name: docker login
@@ -120,7 +120,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -149,7 +149,7 @@ jobs:
     runs-on: [self-hosted, Shire]
     
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -178,7 +178,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -207,7 +207,7 @@ jobs:
     runs-on: [self-hosted, Shire]
     
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -236,7 +236,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -265,7 +265,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -296,7 +296,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -330,7 +330,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -358,7 +358,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-bigdl-llm-gramine-base' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -390,7 +390,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-bigdl-llm-gramine-ref' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -423,7 +423,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-dl-serving-gramine-base' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -453,7 +453,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-dl-serving-gramine-ref' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -486,7 +486,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-deep-learning-gramine-base' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -517,7 +517,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-deep-learning-gramine-ref' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -552,7 +552,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -637,7 +637,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -705,7 +705,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -741,7 +741,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
         with:
           ref: ${{ github.event.inputs.sha }}
       - name: docker login
@@ -777,7 +777,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -813,7 +813,7 @@ jobs:
     runs-on: [ self-hosted, Shire ]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
         with:
          ref: ${{ github.event.inputs.sha }}
       - name: docker login
@@ -859,7 +859,7 @@ jobs:
     runs-on: [ self-hosted, Shire ]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
         with:
           ref: ${{ github.event.inputs.sha }}
       - name: docker login
@@ -897,7 +897,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -933,7 +933,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -969,7 +969,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker deploy kms-util
@@ -996,7 +996,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker deploy pccs
@@ -1020,7 +1020,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-python-toolkit-base' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -1050,7 +1050,7 @@ jobs:
     if: ${{ github.event.inputs.artifact == 'bigdl-ppml-trusted-python-toolkit-ref' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Shire]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
@@ -1084,7 +1084,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.sha }}
     - name: docker login
diff --git a/.github/workflows/nano-nightly-test.yml b/.github/workflows/nano-nightly-test.yml
index 9f208888b62..17ce1b20eab 100644
--- a/.github/workflows/nano-nightly-test.yml
+++ b/.github/workflows/nano-nightly-test.yml
@@ -34,7 +34,7 @@ jobs:
         python-version: ["3.8", "3.9", "3.10"]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up Nano PyTorch Env
       uses: ./.github/actions/nano/setup-pytorch-env
       with:
@@ -67,7 +67,7 @@ jobs:
         python-version: ["3.8", "3.9", "3.10"]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up Nano Tensorflow Env
       uses: ./.github/actions/nano/setup-tensorflow-env
       with:
@@ -100,7 +100,7 @@ jobs:
         python-version: ["3.8"]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up Nano PyTorch Env
       uses: ./.github/actions/nano/setup-pytorch-env
       with:
@@ -120,7 +120,7 @@ jobs:
         python-version: ["3.8"]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up Nano Tensorflow Env
       uses: ./.github/actions/nano/setup-tensorflow-env
       with:
@@ -140,7 +140,7 @@ jobs:
         python-version: ["3.8"]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up Nano PyTorch Env
       uses: ./.github/actions/nano/setup-pytorch-env
       with:
@@ -162,7 +162,7 @@ jobs:
         python-version: ["3.8"]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up Nano Tensorflow Env
       uses: ./.github/actions/nano/setup-tensorflow-env
       with:
@@ -178,7 +178,7 @@ jobs:
   create-workflow-badge:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: create workflow badge
       if: ${{ always() }}
       uses: ./.github/actions/create-job-status-badge
diff --git a/.github/workflows/nano_howto_guides_tests.yml b/.github/workflows/nano_howto_guides_tests.yml
index bb40ebc9b51..f215619017a 100644
--- a/.github/workflows/nano_howto_guides_tests.yml
+++ b/.github/workflows/nano_howto_guides_tests.yml
@@ -36,7 +36,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v2
         with:
@@ -106,7 +106,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v2
         with:
@@ -166,7 +166,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v2
         with:
diff --git a/.github/workflows/nano_notebooks_tests.yml b/.github/workflows/nano_notebooks_tests.yml
index 6104481c730..8e6b0ec6c18 100644
--- a/.github/workflows/nano_notebooks_tests.yml
+++ b/.github/workflows/nano_notebooks_tests.yml
@@ -37,7 +37,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v2
         with:
@@ -146,7 +146,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v2
         with:
@@ -208,7 +208,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v2
         with:
diff --git a/.github/workflows/nano_unit_tests_basic.yml b/.github/workflows/nano_unit_tests_basic.yml
index 1547b29ab48..26944fb7884 100644
--- a/.github/workflows/nano_unit_tests_basic.yml
+++ b/.github/workflows/nano_unit_tests_basic.yml
@@ -32,7 +32,7 @@ jobs:
         os: ["ubuntu-20.04"]
         python-version: ["3.8"]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v2
         with:
diff --git a/.github/workflows/nano_unit_tests_pytorch.yml b/.github/workflows/nano_unit_tests_pytorch.yml
index f0cbe4ef439..fe78b1edb70 100644
--- a/.github/workflows/nano_unit_tests_pytorch.yml
+++ b/.github/workflows/nano_unit_tests_pytorch.yml
@@ -39,7 +39,7 @@ jobs:
           "pytorch_20 neural-compressor==2.1 https://intel-extension-for-pytorch.s3.amazonaws.com/ipex_stable/cpu/oneccl_bind_pt-2.0.0%2Bcpu-cp38-cp38-linux_x86_64.whl",
           ]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v2
         with:
@@ -118,7 +118,7 @@ jobs:
           "pytorch_20 neural-compressor==2.1 https://intel-extension-for-pytorch.s3.amazonaws.com/ipex_stable/cpu/oneccl_bind_pt-2.0.0%2Bcpu-cp38-cp38-linux_x86_64.whl",
           ]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
 
       - name: Run PyTorch unit tests(Ray)
         shell: bash
@@ -243,7 +243,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v2
         with:
@@ -294,7 +294,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v2
         with:
diff --git a/.github/workflows/nano_unit_tests_tensorflow.yml b/.github/workflows/nano_unit_tests_tensorflow.yml
index 966374e062a..e2d47b20053 100644
--- a/.github/workflows/nano_unit_tests_tensorflow.yml
+++ b/.github/workflows/nano_unit_tests_tensorflow.yml
@@ -46,7 +46,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v2
         with:
@@ -112,7 +112,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: Install dependencies
         run: |
           sudo apt-get update && sudo apt-get install openmpi-bin openmpi-doc libopenmpi-dev
diff --git a/.github/workflows/nightly-build-example-tests-ppml.yaml b/.github/workflows/nightly-build-example-tests-ppml.yaml
index ca5a06d433b..8dd8e42b9bb 100644
--- a/.github/workflows/nightly-build-example-tests-ppml.yaml
+++ b/.github/workflows/nightly-build-example-tests-ppml.yaml
@@ -38,7 +38,7 @@ jobs:
     runs-on: [self-hosted, SGX, Wilwarin]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: set variable
       env:
         DEFAULT_EXAMPLE: 'ALL'
diff --git a/.github/workflows/nightly_build.yml b/.github/workflows/nightly_build.yml
index e022aa3defc..39a18d5253f 100644
--- a/.github/workflows/nightly_build.yml
+++ b/.github/workflows/nightly_build.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: [self-hosted, Bree]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
@@ -183,7 +183,7 @@ jobs:
     runs-on: [self-hosted, Shire]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: set env
       env:
         DEFAULT_TAG: 'latest'
@@ -313,7 +313,7 @@ jobs:
     runs-on: [self-hosted, Bree]
     needs: llm-cpp-build
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
 
@@ -365,7 +365,7 @@ jobs:
     runs-on: [self-hosted, Bree]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -490,7 +490,7 @@ jobs:
   create-workflow-badge:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: create workflow badge
       if: ${{ always() }}
       uses: ./.github/actions/create-job-status-badge
diff --git a/.github/workflows/nightly_test.yml b/.github/workflows/nightly_test.yml
index 2871da1f22b..4cf5f77f8c9 100644
--- a/.github/workflows/nightly_test.yml
+++ b/.github/workflows/nightly_test.yml
@@ -103,7 +103,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Setup env
@@ -130,7 +130,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Setup env
@@ -157,7 +157,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Setup env
@@ -184,7 +184,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Setup env
@@ -211,7 +211,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Setup env
@@ -238,7 +238,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Setup env
@@ -265,7 +265,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Setup env
@@ -292,7 +292,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Setup env
@@ -319,7 +319,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Setup env
@@ -346,7 +346,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -375,7 +375,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -404,7 +404,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -433,7 +433,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -462,7 +462,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -491,7 +491,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -520,7 +520,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -549,7 +549,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -578,7 +578,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -607,7 +607,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -636,7 +636,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -665,7 +665,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -694,7 +694,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -723,7 +723,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -752,7 +752,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -781,7 +781,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -810,7 +810,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -839,7 +839,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -868,7 +868,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -897,7 +897,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -926,7 +926,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -955,7 +955,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -984,7 +984,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1013,7 +1013,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1042,7 +1042,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1072,7 +1072,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1101,7 +1101,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1130,7 +1130,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1159,7 +1159,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1188,7 +1188,7 @@ jobs:
     runs-on: [self-hosted, Gondolin-Ctx]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Setup env
       uses: ./.github/actions/orca/setup-env/setup-orca-ray-ctx-py37
     - name: Run Test
@@ -1213,7 +1213,7 @@ jobs:
     runs-on: [self-hosted, Gondolin-resources, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1242,7 +1242,7 @@ jobs:
     runs-on: [self-hosted, Vilvarin]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: set env
       env:
         DEFAULT_IMAGE: '10.239.45.10/arda/intelanalytics/bigdl-orca'
@@ -1272,7 +1272,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1296,7 +1296,7 @@ jobs:
     runs-on: [ self-hosted, ubuntu-20.04-lts, CLX, AVX512, Ettenmoors ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1320,7 +1320,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1344,7 +1344,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1373,7 +1373,7 @@ jobs:
     runs-on: [self-hosted, SGX, Wilwarin]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1407,7 +1407,7 @@ jobs:
     runs-on: [self-hosted, EDMM]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: Set up JDK8
         uses: ./.github/actions/jdk-setup-action
       - name: Set up maven
@@ -1441,7 +1441,7 @@ jobs:
     runs-on: [self-hosted, Vilvarin]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: set env
       env:
         DEFAULT_IMAGE: '10.239.45.10/arda/intelanalytics/bigdl-ppml-trusted-realtime-ml-scala-occlum'
@@ -1471,7 +1471,7 @@ jobs:
     runs-on: [self-hosted, Vilvarin-root]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: set env
       env:
         DEFAULT_IMAGE: '10.239.45.10/arda/intelanalytics/bigdl-ppml-trusted-realtime-ml-scala-occlum'
@@ -1502,7 +1502,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
     
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1531,7 +1531,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
     
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1560,7 +1560,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
     
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1589,7 +1589,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
     
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1618,7 +1618,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
     
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1647,7 +1647,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
     
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1676,7 +1676,7 @@ jobs:
     runs-on: [self-hosted, SGX, Wilwarin]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -1710,7 +1710,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up Maven
@@ -1739,7 +1739,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up Maven
@@ -1768,7 +1768,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up Maven
@@ -1797,7 +1797,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up Maven
@@ -1826,7 +1826,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up Maven
@@ -1855,7 +1855,7 @@ jobs:
     runs-on: [ self-hosted, Gondolin, ubuntu-20.04-lts ]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up Maven
@@ -1884,7 +1884,7 @@ jobs:
   create-workflow-badge:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: create workflow badge
       if: ${{ always() }}
       uses: ./.github/actions/create-job-status-badge
diff --git a/.github/workflows/performance-regression-test.yml b/.github/workflows/performance-regression-test.yml
index 9610d7782b3..97a7a7119fa 100644
--- a/.github/workflows/performance-regression-test.yml
+++ b/.github/workflows/performance-regression-test.yml
@@ -21,12 +21,12 @@ jobs:
       # trigged by opening a PR which modifies this file or scheduling or commenting 'APRT' in a closed PR
       - name: checkout (open pr or schedule or closed pr comments)
         if: github.event.pull_request || github.event.schedule || github.event.issue.pull_request.merged_at
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
 
       # trigged by commenting 'APRT' in an opening PR
       - name: checkout (opening pr comments)
         if: github.event.issue.pull_request && !github.event.issue.pull_request.merged_at
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
         with:
           ref: ${{ format('refs/pull/{0}/merge', github.event.issue.number) }}
 
diff --git a/.github/workflows/python-style-check.yml b/.github/workflows/python-style-check.yml
index 39de24d3811..dca90bec738 100644
--- a/.github/workflows/python-style-check.yml
+++ b/.github/workflows/python-style-check.yml
@@ -36,7 +36,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # actions/checkout@v2
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v2
@@ -110,7 +110,7 @@ jobs:
     if: github.event.pull_request == ''
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: create workflow badge
       if: ${{ always() }}
       uses: ./.github/actions/create-job-status-badge
diff --git a/.github/workflows/scala-style-check.yml b/.github/workflows/scala-style-check.yml
index b87ac7ae3be..487dd485832 100644
--- a/.github/workflows/scala-style-check.yml
+++ b/.github/workflows/scala-style-check.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK 8
       uses: actions/setup-java@v3
       with:
@@ -80,7 +80,7 @@ jobs:
     if: github.event.pull_request == ''
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: create workflow badge
       if: ${{ always() }}
       uses: ./.github/actions/create-job-status-badge
diff --git a/.github/workflows/sdl_hadolint.yml b/.github/workflows/sdl_hadolint.yml
index 3135a74cee3..6619df88d77 100644
--- a/.github/workflows/sdl_hadolint.yml
+++ b/.github/workflows/sdl_hadolint.yml
@@ -16,7 +16,7 @@ jobs:
   scan-dockerfile:
     runs-on: [self-hosted, SDL-TEST]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: "bigdl-k8s-dockerfile-scanning"
       run: |
         docker run --rm -i hadolint/hadolint < ./docker/bigdl-k8s/Dockerfile
diff --git a/.github/workflows/sdl_snyk_docker.yml b/.github/workflows/sdl_snyk_docker.yml
index 37d165f7140..47736640f3a 100644
--- a/.github/workflows/sdl_snyk_docker.yml
+++ b/.github/workflows/sdl_snyk_docker.yml
@@ -25,7 +25,7 @@ jobs:
   snyk-docker:
     runs-on: [self-hosted, SDL-TEST]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: set env
       run: |
         echo "IMAGE=${{inputs.snyk_image}}"
diff --git a/.github/workflows/sdl_snyk_python.yml b/.github/workflows/sdl_snyk_python.yml
index c3e3426b592..a9684d82058 100644
--- a/.github/workflows/sdl_snyk_python.yml
+++ b/.github/workflows/sdl_snyk_python.yml
@@ -27,7 +27,7 @@ jobs:
   snyk-python:
     runs-on: [self-hosted, SDL]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: set env
       run: |
         echo "SNYK_APITOKEN=${{inputs.snyk_apitoken}}"
diff --git a/.github/workflows/sdl_snyk_scala.yml b/.github/workflows/sdl_snyk_scala.yml
index 1625ab7bfd8..a927cab204a 100644
--- a/.github/workflows/sdl_snyk_scala.yml
+++ b/.github/workflows/sdl_snyk_scala.yml
@@ -25,7 +25,7 @@ jobs:
   snyk-scala:
     runs-on: [self-hosted, SDL]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: "run Snyk test scan Spark 2.4.6"
       env: 
           no_proxy: snyk.devtools.intel.com, intel.com
diff --git a/.github/workflows/sdl_virus-malware.yml b/.github/workflows/sdl_virus-malware.yml
index 46ad4a0ecef..2006419214d 100644
--- a/.github/workflows/sdl_virus-malware.yml
+++ b/.github/workflows/sdl_virus-malware.yml
@@ -16,7 +16,7 @@ jobs:
   scan-virus:
     runs-on: [self-hosted, SDL]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: "virus-malware-scanning"
       run: |
         uvscan --RPTOBJECTS --RECURSIVE --UNZIP --HTML=scan-report.html --LOUD --SUMMARY --ANALYZE --PANALYZE .
diff --git a/.github/workflows/url-auto-merge.yml b/.github/workflows/url-auto-merge.yml
index 7ee70cdd369..137f082a4d5 100644
--- a/.github/workflows/url-auto-merge.yml
+++ b/.github/workflows/url-auto-merge.yml
@@ -14,7 +14,7 @@ jobs:
   createPRandAutoMerge:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
         with:
           fetch-depth: 0
       - name: Update time
diff --git a/.github/workflows/url_check.yml b/.github/workflows/url_check.yml
index 9b56d0684f4..d66910cadf3 100644
--- a/.github/workflows/url_check.yml
+++ b/.github/workflows/url_check.yml
@@ -14,7 +14,7 @@ jobs:
   checkDownloadURL:
     runs-on: [self-hosted, Gondolin, ubuntu-20.04-lts]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: Run a url check script
         run: |
             url_list=$(grep -wio "https://oss[0-9_a-zA-Z\/.\-]*" docs/readthedocs/source/doc/Orca/Overview/install.md)
diff --git a/.github/workflows/weekly_test.yml b/.github/workflows/weekly_test.yml
index 3e4edc3474a..bdbbf762d3c 100644
--- a/.github/workflows/weekly_test.yml
+++ b/.github/workflows/weekly_test.yml
@@ -46,7 +46,7 @@ jobs:
     runs-on: [self-hosted, Vilvarin]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: set env
       env:
         DEFAULT_IMAGE: '10.239.45.10/arda/intelanalytics/bigdl-ppml-trusted-big-data-ml-scala-occlum'
@@ -76,7 +76,7 @@ jobs:
     runs-on: [self-hosted, EDMM]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
       - name: set env
         env:
           DEFAULT_IMAGE: '10.239.45.10/arda/intelanalytics/bigdl-ppml-trusted-big-data-ml-scala-occlum'
@@ -106,7 +106,7 @@ jobs:
     runs-on: [self-hosted, Vilvarin]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -140,7 +140,7 @@ jobs:
     runs-on: [self-hosted, Vilvarin]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -173,7 +173,7 @@ jobs:
     if: ${{ github.event.schedule || github.event.inputs.artifact == 'PPML-Spark-PySpark-Local-Sql-UT-On-Gramine' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, SGX, Wilwarin]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -206,7 +206,7 @@ jobs:
     if: ${{ github.event.schedule || github.event.inputs.artifact == 'PPML-Spark-K8S-TPC-H-On-Gramine' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Vilvarin]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -239,7 +239,7 @@ jobs:
     if: ${{ github.event.schedule || github.event.inputs.artifact == 'PPML-Spark-K8S-TPC-DS-On-Gramine' || github.event.inputs.artifact == 'all' }}
     runs-on: [self-hosted, Vilvarin]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -274,7 +274,7 @@ jobs:
     runs-on: [self-hosted, SGX, Wilwarin]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: Set up JDK8
       uses: ./.github/actions/jdk-setup-action
     - name: Set up maven
@@ -307,7 +307,7 @@ jobs:
   create-workflow-badge:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # actions/checkout@v3
     - name: create workflow badge
       if: ${{ always() }}
       uses: ./.github/actions/create-job-status-badge