CLOUD-392 Pin Github Actions to release SHA

Author: michelesr

.github/workflows/deploy-energy-apps.yaml

@@ -17,9 +17,9 @@ jobs:
       contents: read
       issues: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
       - name: Build and push to ECR
-        uses: citizensadvice/build-and-private-ecr-push-action@v3
+        uses: citizensadvice/build-and-private-ecr-push-action@353b5a92d28241f7bef7c1c88dc18759797b0da0
         with:
           dockerfile_context: "."
           repository_name: energy-apps
@@ -44,7 +44,7 @@ jobs:
       name: ${{ matrix.stage }}
     steps:
       - name: Git Checkout energy apps
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           path: energy-apps
       - name: Set environment variables from cdk context
@@ -54,7 +54,7 @@ jobs:
               echo "$s" >> $GITHUB_ENV
           done
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
         with:
           role-to-assume: "arn:aws:iam::${{env.AWS_ACCOUNT}}:role/EnergyAppsDeployment"
           role-session-name: ${{matrix.stage}}-energy-apps-actions-workflow

.github/workflows/docker-image-scan.yml

@@ -15,27 +15,27 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
         with:
           python-version: '3.13'
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
         with:
           role-to-assume: arn:aws:iam::979633842206:role/EnergyAppsDeployment
           role-session-name: energy-apps-trivy-scan
           aws-region: eu-west-1
 
       - name: ECR login
         id: ecr-login
-        uses: aws-actions/amazon-ecr-login@v2
+        uses: aws-actions/amazon-ecr-login@183a1442edf41672e66566b7fc560e297a290896
         with:
           registry-type: private
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
         id: trivy-scan
         env:
           TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
@@ -49,7 +49,7 @@ jobs:
 
       - name: Upload scan results
         id: upload-artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
         with:
           name: trivy-scan-results
           path: trivy-results.json
@@ -75,7 +75,7 @@ jobs:
     if: failure()
     steps:
       - name: Notify Slack
-        uses: citizensadvice/message-slack-action@v2
+        uses: citizensadvice/message-slack-action@306ad8b4768287c24be25ebc9c0dd9d2af55a20a
         with:
           slack_bot_token: ${{ secrets.SLACK_BOT_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/lint_and_test.yml

@@ -8,20 +8,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: "Setup ruby"
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64
         with:
           bundler-cache: true
 
       - name: "Setup node"
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
         with:
           node-version-file: .nvmrc
 
       - name: "Install npm packages"
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb
 
       - name: "Node lint"
         run: yarn run lint
@@ -37,20 +37,20 @@ jobs:
     needs: lint
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: "Setup ruby"
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64
         with:
           bundler-cache: true
 
       - name: "Setup node"
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
         with:
           node-version-file: .nvmrc
 
       - name: "Install npm packages"
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb
 
       - name: "Precompile assets"
         run: bundle exec rails assets:precompile
@@ -63,10 +63,10 @@ jobs:
     needs: lint
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: "Setup ruby"
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64
         with:
           bundler-cache: true
 
@@ -91,20 +91,20 @@ jobs:
     needs: lint
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: "Setup ruby"
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64
         with:
           bundler-cache: true
 
       - name: "Setup node"
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
         with:
           node-version-file: .nvmrc
 
       - name: "Install npm packages"
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb
 
       - name: "Precompile assets"
         run: bundle exec rails assets:precompile
@@ -113,7 +113,7 @@ jobs:
         run: bundle exec cucumber
 
       # Archive test logs
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
         if: failure()
         with:
           name: test-logs

.github/workflows/review-app-create.yml

@@ -26,9 +26,9 @@ jobs:
     # are created and destroyed on every push for no reason.
     if: contains(github.event.pull_request.labels.*.name, 'Review app')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
       - name: Build and push to ECR
-        uses: citizensadvice/build-and-private-ecr-push-action@v3
+        uses: citizensadvice/build-and-private-ecr-push-action@353b5a92d28241f7bef7c1c88dc18759797b0da0
         with:
           dockerfile_context: "."
           repository_name: energy-apps
@@ -50,12 +50,12 @@ jobs:
     needs: build
     steps:
       - name: Git Checkout energy comparison table
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           path: energy-apps
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
         with:
           role-to-assume: "arn:aws:iam::979633842206:role/EnergyAppsDeployment"
           role-session-name: energy-apps-actions-workflow
@@ -103,7 +103,7 @@ jobs:
           energy-apps/infrastructure/app/chart/energy-apps
 
       - name: Find Comment
-        uses: peter-evans/find-comment@v4
+        uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad
         id: find-comment
         if: contains(github.event.pull_request.labels.*.name, 'Review app')
         with:
@@ -113,7 +113,7 @@ jobs:
           direction: last
 
       - name: Add New Comment
-        uses: peter-evans/create-or-update-comment@v5
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
         if: steps.find-comment.outputs.comment-id == 0 && contains(github.event.pull_request.labels.*.name, 'Review app')
         with:
           issue-number: ${{ github.event.pull_request.number }}
@@ -129,7 +129,7 @@ jobs:
             To destroy the review app remove the label `Review app`, close this PR or convert it to draft.
 
       - name: Update Comment
-        uses: peter-evans/create-or-update-comment@v5
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
         if: steps.find-comment.outputs.comment-id && contains(github.event.pull_request.labels.*.name, 'Review app')
         with:
           issue-number: ${{ github.event.pull_request.number }}

.github/workflows/review-app-destroy.yml

@@ -27,7 +27,7 @@ jobs:
     if: github.event.label.name == 'Review app' || inputs.pr_number
     steps:
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
         with:
           role-to-assume: "arn:aws:iam::979633842206:role/EnergyAppsDeployment"
           role-session-name: energy-app-actions-workflow
@@ -47,13 +47,13 @@ jobs:
 
       - name: Remove Review app label
         if: contains(github.event.pull_request.labels.*.name, 'Review app') || inputs.pr_number
-        uses: actions-ecosystem/action-remove-labels@v1.3.0
+        uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0
         with:
           labels: "Review app"
           number: ${{ github.event.issue.number || github.event.pull_request.number || inputs.pr_number }}
 
       - name: Find Comment
-        uses: peter-evans/find-comment@v4
+        uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad
         id: find-comment
         with:
           issue-number: ${{ env.PR_NUMBER }}
@@ -62,7 +62,7 @@ jobs:
           direction: last
 
       - name: Update Comment
-        uses: peter-evans/create-or-update-comment@v5
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
         if: steps.find-comment.outputs.comment-id
         with:
           issue-number: ${{ env.PR_NUMBER }}

.github/workflows/review-app-scan.yml

@@ -22,7 +22,7 @@ jobs:
       matrix: ${{ steps.scan.outputs.matrix }}
     steps:
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
         with:
           role-to-assume: "arn:aws:iam::979633842206:role/EnergyAppsDeployment"
           role-session-name: energy-apps-actions-workflow

.github/workflows/upload-js-to-datadog.yml

@@ -16,20 +16,20 @@ jobs:
       IMAGE_TAG: ${{ github.sha }}
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: "Setup ruby"
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64
         with:
           bundler-cache: true
 
       - name: "Setup node"
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
         with:
           node-version-file: .nvmrc
 
       - name: "Install npm packages"
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb
 
       - name: "Install datadog-ci upload tools"
         run: npm install -g @datadog/datadog-ci