Merge pull request #425 from citizensadvice/CLOUD-392_Pin_Github_Actions_to_release_SHA

CLOUD-392 Pin Github Actions to release SHA

Author: marianayovcheva

.github/workflows/cdk_diff.yml

@@ -13,16 +13,16 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
         with:
           role-to-assume: "arn:aws:iam::979633842206:role/LocalOfficeSearchApiDeployment"
           aws-region: eu-west-1
           role-session-name: local-office-search-api-actions-workflow
 
-      - uses: citizensadvice/python-poetry-setup-action@v1
+      - uses: citizensadvice/python-poetry-setup-action@238df99ffcab064c3054cbd39b461108e04882e3
         with:
           install_cdk: true
           project_root: "./cdk"
@@ -53,22 +53,22 @@ jobs:
           EOF
 
       - name: Find Comment
-        uses: peter-evans/find-comment@v4
+        uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad
         id: find-comment
         with:
           issue-number: ${{ github.event.pull_request.number }}
           comment-author: "github-actions[bot]"
           direction: last
 
       - name: Add New Comment
-        uses: peter-evans/create-or-update-comment@v5
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
         if: steps.find-comment.outputs.comment-id == 0
         with:
           issue-number: ${{ github.event.pull_request.number }}
           body-file: "comment.md"
 
       - name: Update Comment
-        uses: peter-evans/create-or-update-comment@v5
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
         if: steps.find-comment.outputs.comment-id
         with:
           issue-number: ${{ github.event.pull_request.number }}

.github/workflows/db_migration.yml

@@ -19,7 +19,7 @@ jobs:
       name: ${{ inputs.env }}
     steps:
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
         with:
           role-to-assume: "arn:aws:iam::${{ vars.AWS_ACCOUNT }}:role/LocalOfficeSearchApiDeployment"
           role-session-name: local-office-search-api-${{ inputs.env }}-db-migrate-workflow

.github/workflows/deploy_stage.yml

@@ -28,15 +28,15 @@ jobs:
         shell: bash
         if: inputs.stage == 'prod'
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
-      - uses: citizensadvice/python-poetry-setup-action@v1
+      - uses: citizensadvice/python-poetry-setup-action@238df99ffcab064c3054cbd39b461108e04882e3
         with:
           install_cdk: true
           project_root: "./cdk"
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
         with:
           role-to-assume: "arn:aws:iam::${{ vars.AWS_ACCOUNT }}:role/LocalOfficeSearchApiDeployment"
           role-session-name: local-office-search-api-deploy-${{ inputs.stage }}-workflow
@@ -55,7 +55,7 @@ jobs:
       - deploy
     steps:
       - name: Notify Slack
-        uses: citizensadvice/message-slack-action@v1
+        uses: citizensadvice/message-slack-action@c510788139115d15c3b36f95a3497c6b15172165
         with:
           slack_bot_token: ${{ secrets.SLACK_BOT_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -72,7 +72,7 @@ jobs:
     if: failure()
     steps:
       - name: Notify Slack
-        uses: citizensadvice/message-slack-action@v1
+        uses: citizensadvice/message-slack-action@c510788139115d15c3b36f95a3497c6b15172165
         with:
           slack_bot_token: ${{ secrets.SLACK_BOT_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/dev_deploy.yml

@@ -14,9 +14,9 @@ jobs:
       contents: read
       issues: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
       - name: Build and push to ECR
-        uses: citizensadvice/build-and-private-ecr-push-action@v3
+        uses: citizensadvice/build-and-private-ecr-push-action@353b5a92d28241f7bef7c1c88dc18759797b0da0
         with:
           role_arn: "arn:aws:iam::979633842206:role/LocalOfficeSearchApiDeployment"
           dockerfile_context: "."

.github/workflows/docker-image-scan.yml

@@ -15,27 +15,27 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
         with:
           python-version: '3.13'
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
         with:
           role-to-assume: arn:aws:iam::979633842206:role/LocalOfficeSearchApiDeployment
           role-session-name: local-office-search-api-trivy-scan
           aws-region: eu-west-1
 
       - name: ECR login
         id: ecr-login
-        uses: aws-actions/amazon-ecr-login@v2
+        uses: aws-actions/amazon-ecr-login@183a1442edf41672e66566b7fc560e297a290896
         with:
           registry-type: private
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
         id: trivy-scan
         env:
           TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
@@ -49,7 +49,7 @@ jobs:
 
       - name: Upload scan results
         id: upload-artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
         with:
           name: trivy-scan-results
           path: trivy-results.json
@@ -75,7 +75,7 @@ jobs:
     if: failure()
     steps:
       - name: Notify Slack
-        uses: citizensadvice/message-slack-action@v1
+        uses: citizensadvice/message-slack-action@c510788139115d15c3b36f95a3497c6b15172165
         with:
           slack_bot_token: ${{ secrets.SLACK_BOT_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/lint_and_test.yml

@@ -8,18 +8,18 @@ jobs:
     runs-on: runs-on
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: "Setup ruby"
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64
         with:
           bundler-cache: true
 
       - name: "Ruby lint"
         run: bundle exec rubocop --format progress --format github
 
       - name: "Python lint"
-        uses: chartboost/ruff-action@v1
+        uses: chartboost/ruff-action@e18ae971ccee1b2d7bbef113930f00c670b78da4
         with:
           src: "./cdk"
 
@@ -43,10 +43,10 @@ jobs:
 
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: "Setup ruby"
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64
         with:
           bundler-cache: true
 
@@ -61,10 +61,10 @@ jobs:
     needs: lint
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: "Setup ruby"
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64
         with:
           bundler-cache: true
 

.github/workflows/sync_database.yml

@@ -19,7 +19,7 @@ jobs:
       name: ${{ inputs.env }}
     steps:
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
         with:
           role-to-assume: "arn:aws:iam::${{ vars.AWS_ACCOUNT }}:role/LocalOfficeSearchApiDeployment"
           role-session-name: local-office-search-api-${{ inputs.env }}-sync-workflow