Merge pull request #73 from CISA-SBOM-Community/minder_replace_unpinned_actions_with_pinned_action

Replace unpinned actions with pinned action

Author: vpetersson

.github/workflows/phase_2_harbor.yml

@@ -51,14 +51,14 @@ jobs:
             harbor-${HARBOR_TAG}
 
       - name: Upload Generated CycloneDX SBOM
-        uses: actions/upload-artifact@v4 # v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
         with:
           name: generated-harbor-sbom-cyclonedx
           path: "/tmp/generated-harbor-sbom.cdx.json"
           if-no-files-found: error
 
       - name: Upload Generated SPDX SBOM
-        uses: actions/upload-artifact@v4 # v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
         with:
           name: generated-harbor-sbom-spdx
           path: "/tmp/generated-harbor-sbom.spdx.json"
@@ -72,10 +72,10 @@ jobs:
     needs: Generate
     steps:
 
-      - uses: actions/checkout@v4 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Download all workflow run artifacts
-        uses: actions/download-artifact@v4 # v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
 
       - name: Augment Stage - List Downloaded Artifacts
         run: ls -lha
@@ -125,13 +125,13 @@ jobs:
               augmented_harbor-sbom.cdx.json > /tmp/augmented_harbor-sbom.cdx.json
       
       - name: Upload Augmented SPDX SBOM
-        uses: actions/upload-artifact@v4 # v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
         with:
           name: augmented-harbor-sbom-spdx
           path: "/tmp/augmented_harbor-sbom.spdx.json"
 
       - name: Upload Augmented CycloneDX SBOM
-        uses: actions/upload-artifact@v4 # v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
         with:
           name: augmented-harbor-sbom-cyclonedx
           path: "/tmp/augmented_harbor-sbom.cdx.json"
@@ -141,15 +141,15 @@ jobs:
     needs: Augment
     steps:
 
-      - uses: actions/checkout@v4 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Enrich Download all workflow run artifacts
-        uses: actions/download-artifact@v4 # v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
 
       - name: Enrich Stage - List Downloaded Artifacts
         run: ls -lha
 
       - name: Enrich Stage - Download all workflow run artifacts
-        uses: actions/download-artifact@v4 # v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
 
       - name: Install parlay
         run: |
@@ -167,13 +167,13 @@ jobs:
             augmented-harbor-sbom-spdx/augmented_harbor-sbom.spdx.json > /tmp/enriched_harbor-sbom.spdx.json
 
       - name: Upload Enriched SPDX SBOM
-        uses: actions/upload-artifact@v4 # v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
         with:
           name: enriched-harbor-sbom-spdx
           path: "/tmp/enriched_harbor-sbom.spdx.json"
 
       - name: Upload Enriched CycloneDX SBOM
-        uses: actions/upload-artifact@v4 # v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
         with:
           name: enriched-harbor-sbom-cyclonedx
           path: "/tmp/enriched_harbor-sbom.cdx.json"
@@ -184,13 +184,13 @@ jobs:
           cp /tmp/enriched_harbor-sbom.cdx.json /tmp/final_harbor-sbom.cdx.json
 
       - name: Upload Final SPDX SBOM
-        uses: actions/upload-artifact@v4 # v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
         with:
           name: final-harbor-sbom-spdx
           path: "/tmp/final_harbor-sbom.spdx.json"
 
       - name: Upload Final CycloneDX SBOM
-        uses: actions/upload-artifact@v4 # v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
         with:
           name: final-harbor-sbom-cyclonedx
           path: "/tmp/final_harbor-sbom.cdx.json"