fix: usage specific Commit SHA for CI

Author: miccy

.github/workflows/ci.yaml

@@ -18,10 +18,10 @@ jobs:
   ci:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@f453a2b535d48227b203c9c9f7a77e089201a403 # v2.0.0
         with:
           bun-version: "1.3.8"
 

.github/workflows/docker.yaml

@@ -23,7 +23,7 @@ jobs:
       id-token: write
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Check if version already published
         id: version
@@ -46,23 +46,23 @@ jobs:
 
       - name: Set up QEMU
         if: ${{ steps.version.outputs.changed == 'true' }}
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
 
       - name: Set up Docker Buildx
         if: ${{ steps.version.outputs.changed == 'true' }}
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@988b5a0280414f521da3d829df8432753fbd92d2 # v3.6.1
 
       - name: Log in to Docker Hub
         if: ${{ github.repository == 'evoluhq/evolu' && steps.version.outputs.changed == 'true' }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Extract metadata (tags, labels) for Docker
         if: ${{ steps.version.outputs.changed == 'true' }}
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           flavor: |
@@ -76,7 +76,7 @@ jobs:
       - name: Build and push Docker image
         if: ${{ github.repository == 'evoluhq/evolu' && steps.version.outputs.changed == 'true' }}
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@32945a339266b759abcbdc89316bb68de327d74b # v6.7.0
         with:
           platforms: linux/amd64,linux/arm64
           context: .
@@ -93,7 +93,7 @@ jobs:
 
       - name: Generate artifact attestation
         if: ${{ github.repository == 'evoluhq/evolu' && steps.version.outputs.changed == 'true' }}
-        uses: actions/attest-build-provenance@v1
+        uses: actions/attest-build-provenance@897ed5eab10ec6095258600c7e5e2195f007b46d # v1.4.1
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.push.outputs.digest }}

.github/workflows/release.yaml

@@ -18,8 +18,8 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: oven-sh/setup-bun@f453a2b535d48227b203c9c9f7a77e089201a403 # v2.0.0
         with:
           bun-version: "1.3.8"
 
@@ -31,7 +31,7 @@ jobs:
 
       - name: Create Release Pull Request or Publish
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@aba2c841fbc6b30f889c450c3995817c1bf05285 # v1
         with:
           publish: bun run changeset publish
           createGithubReleases: true

.github/workflows/socket.yaml

@@ -27,12 +27,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           # For PRs, fetch one additional commit for proper diff analysis
           fetch-depth: ${{ github.event_name == 'pull_request' && 2 || 0 }}
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: "3.12"
 

.github/workflows/web-build.yaml

@@ -24,10 +24,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@f453a2b535d48227b203c9c9f7a77e089201a403 # v2.0.0
         with:
           bun-version: "1.3.8"