chore: pin GitHub Actions to commit SHAs (#7813)

## Pin GitHub Actions to commit SHAs

GitHub Actions referenced by tag (e.g. `actions/checkout@v4`) use a
mutable pointer — the tag owner can move it to a different commit at any
time, including a malicious one. This is the attack vector used in the
tj-actions/changed-files incident (CVE-2025-30066).

Pinning to a full 40-character commit SHA makes the reference immutable.
The `# tag` comment preserves human readability so reviewers can tell
which version is pinned.

Important: a SHA can also originate from a forked repository. A
malicious actor can fork an action, push a compromised commit to the
fork, and the SHA will resolve — but it won't exist in the upstream
canonical repo. Each SHA in this PR was verified against the action's
canonical repository (not a fork).

### Changes

- `actions/checkout@v6` ->
`actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2`
  - Version: v6.0.2 | Latest: v6.0.2 | Release age: 88d
- Commit:
actions/checkout@de0fac2

- `actions/upload-artifact@v7` ->
`actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7`
  - Version: v7 | Latest: v3.2.2 | Release age: 22d
- Commit:
actions/upload-artifact@bbbca2d

- `actions/download-artifact@v8` ->
`actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #
v8.0.1`
  - Version: v8.0.1 | Latest: v3.1.0-node20 | Release age: 22d
- Commit:
actions/download-artifact@3e5f45b
- Warnings: 1 security advisory(ies) found, Action has 1 known
advisory(ies)

- `dfinity/setup-dfx@main` ->
`dfinity/setup-dfx@e50c04f104ee4285ec010f10609483cf41e4d365 # main`
  - Version: main | Latest: ? | Release age: ?
- Commit:
dfinity/setup-dfx@e50c04f

- `actions/setup-go@v6` ->
`actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0`
  - Version: v6.4.0 | Latest: v6.4.0 | Release age: 9d
- Commit:
actions/setup-go@4a36011

- `docker/setup-buildx-action@v4` ->
`docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #
v4`
  - Version: v4 | Latest: v4.0.0 | Release age: 34d
- Commit:
docker/setup-buildx-action@4d04d5d

- `docker/build-push-action@v7` ->
`docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7`
  - Version: v7 | Latest: v7.0.0 | Release age: 33d
- Commit:
docker/build-push-action@d08e5c3

- `actions/setup-node@v6` ->
`actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0`
  - Version: v6.3.0 | Latest: v6.3.0 | Release age: 35d
- Commit:
actions/setup-node@53b8394

- `actions/cache@v5` ->
`actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4`
  - Version: v5.0.4 | Latest: v5.0.4 | Release age: 20d
- Commit:
actions/cache@6682284

- `dfinity/internet-identity/.github/actions/slack@release-2023-08-28`
->
`dfinity/internet-identity/.github/actions/slack@b278eab440b6adfcb561f18fe24bdea66c1987c3
# release-2023-08-28`
- Version: release-2023-08-28 | Latest: release-2026-04-03 | Release
age: 11d
- Commit:
dfinity/internet-identity@b278eab
- Warnings: Latest release release-2026-04-03 is only 5 day(s) old (< 7
days). Using previous safe release., 3 security advisory(ies) found,
Action has 3 known advisory(ies)

- `actions/create-github-app-token@v2` ->
`actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349
# v2.2.2`
  - Version: v2.2.2 | Latest: v3.0.0 | Release age: 25d
- Commit:
actions/create-github-app-token@fee1f7d

- `peter-evans/create-pull-request@v8` ->
`peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0
# v8.1.0`
  - Version: v8.1.0 | Latest: v8.1.0 | Release age: 76d
- Commit:
peter-evans/create-pull-request@c0f553f


### Files modified

- `.github/workflows/build.yml`
- `.github/workflows/checks.yml`
- `.github/workflows/deploy-to-app.yaml`
- `.github/workflows/docker-main.yaml`
- `.github/workflows/nightly.yaml`
- `.github/workflows/reproducible.yaml`
- `.github/workflows/tag.yaml`
- `.github/workflows/update-aggregator.yml`
- `.github/workflows/update-didc.yml`
- `.github/workflows/update-ic-cargo-deps.yaml`
- `.github/workflows/update-next.yml`
- `.github/workflows/update-rust.yml`
- `.github/workflows/update-sns-aggregator-response.yml`
- `.github/workflows/update-snsdemo.yml`

### Security warnings

- 1 security advisory(ies) found
- Action has 1 known advisory(ies)
- Latest release release-2026-04-03 is only 5 day(s) old (< 7 days).
Using previous safe release.
- 3 security advisory(ies) found
- Action has 3 known advisory(ies)

---------

Co-authored-by: Yusef Habib <yusef.fernandez@dfinity.org>

Author: slawomirbabicz

.github/workflows/build.yml

@@ -26,7 +26,7 @@ jobs:
       GH_TOKEN: ${{ github.token }}
     steps:
       - name: Checkout nns-dapp
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Skip build for testing
         # Set to true and set a recent `run_id` below to reuse an existing build
         # instead of building.
@@ -45,31 +45,31 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: 'Upload nns-dapp wasm module'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         with:
           name: nns-dapp
           path: out/nns-dapp.wasm.gz
           retention-days: 3
       - name: 'Upload nns-dapp test wasm module'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         with:
           name: nns-dapp_test
           path: out/nns-dapp_test.wasm.gz
           retention-days: 3
       - name: 'Upload sns_aggregator wasm module'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         with:
           name: sns_aggregator
           path: out/sns_aggregator.wasm.gz
           retention-days: 3
       - name: 'Upload sns_aggregator_dev wasm module'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         with:
           name: sns_aggregator_dev
           path: out/sns_aggregator_dev.wasm.gz
           retention-days: 3
       - name: 'Upload whole out directory'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         with:
           name: out
           path: out
@@ -80,7 +80,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout nns-dapp
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Run Playwright e2e test shard 1/2
         uses: ./.github/actions/test-e2e
         with:
@@ -92,7 +92,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout nns-dapp
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Run Playwright e2e test shard 2/2
         uses: ./.github/actions/test-e2e
         with:
@@ -104,17 +104,17 @@ jobs:
     timeout-minutes: 40
     steps:
       - name: Checkout nns-dapp
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Get nns-dapp_test
         # Note: This may be performed manually with ./scripts/docker-build --network local
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: out
           path: out
       - name: Install ic-wasm
         uses: ./.github/actions/install_ic_wasm
       - name: Install dfx
-        uses: dfinity/setup-dfx@main
+        uses: dfinity/setup-dfx@e50c04f104ee4285ec010f10609483cf41e4d365 # main
       - name: Install tools
         run: |
           sudo apt-get update -yy && sudo apt-get install -yy moreutils && command -v sponge
@@ -127,16 +127,16 @@ jobs:
     timeout-minutes: 40
     steps:
       - name: Checkout nns-dapp
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Get nns-dapp_test
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: out
           path: out
       - name: Install ic-wasm
         uses: ./.github/actions/install_ic_wasm
       - name: Install dfx
-        uses: dfinity/setup-dfx@main
+        uses: dfinity/setup-dfx@e50c04f104ee4285ec010f10609483cf41e4d365 # main
       - name: Install tools
         run: |
           sudo apt-get update -yy && sudo apt-get install -yy moreutils && command -v sponge
@@ -147,7 +147,7 @@ jobs:
         run: ./scripts/nns-dapp/migration-test --accounts 1000 --chunk 100
       - name: Upload dfx logs
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         with:
           name: test-upgrade-stable-dfx.log
           path: test-upgrade-stable-dfx.log
@@ -157,9 +157,9 @@ jobs:
     timeout-minutes: 40
     steps:
       - name: Checkout nns-dapp
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Get nns-dapp_test
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: nns-dapp_test
       - name: Start empty nns-dapp
@@ -177,17 +177,17 @@ jobs:
     timeout-minutes: 40
     steps:
       - name: Checkout nns-dapp
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Get nns-dapp
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: nns-dapp
       - name: Get sns_aggregator
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: sns_aggregator
       - name: Get sns_aggregator_dev
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: sns_aggregator_dev
       - name: Start snapshot environment
@@ -197,7 +197,7 @@ jobs:
           sns_aggregator_wasm: 'sns_aggregator_dev.wasm.gz'
           logfile: 'dfx-test-rest.log'
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: '1.25'
       - name: Add go and SNS scripts to the path
@@ -297,7 +297,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout nns-dapp
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       - name: Check dockerfile for changes
@@ -309,12 +309,12 @@ jobs:
           fi
       - name: Set up docker buildx
         if: steps.dockerfile_changed.outputs.dockerfile_changed == 'true'
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
       - name: Create a blank global config
         run: echo "{}" > global-config.json
       - name: Build wasms
         if: steps.dockerfile_changed.outputs.dockerfile_changed == 'true'
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
         with:
           context: .
           file: Dockerfile
@@ -326,19 +326,19 @@ jobs:
           outputs: ./out-mainnet
       - name: Get nns-dapp
         if: steps.dockerfile_changed.outputs.dockerfile_changed == 'true'
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: nns-dapp
           path: out-local
       - name: Get sns_aggregator
         if: steps.dockerfile_changed.outputs.dockerfile_changed == 'true'
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: sns_aggregator
           path: out-local
       - name: Get sns_aggregator_dev
         if: steps.dockerfile_changed.outputs.dockerfile_changed == 'true'
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: sns_aggregator_dev
           path: out-local
@@ -363,9 +363,9 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout nns-dapp
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Get sns_aggregator_dev
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: sns_aggregator_dev
       - name: Start snapshot environment
@@ -467,9 +467,9 @@ jobs:
     needs: build
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Get docker build outputs
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: out
           path: out
@@ -478,7 +478,7 @@ jobs:
       - name: 'Record the git commit and any tags'
         run: git log | head -n1 > out/commit.txt
       - name: 'Upload ${{ matrix.BUILD_NAME }} nns-dapp wasm module'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         with:
           name: nns-dapp for ${{ matrix.BUILD_NAME }}
           path: |
@@ -489,7 +489,7 @@ jobs:
             out/frontend-config.sh
             out/deployment-config.json
       - name: 'Upload sns_aggregator wasm module'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         with:
           name: sns_aggregator for ${{ matrix.BUILD_NAME }}
           path: |
@@ -501,7 +501,7 @@ jobs:
           assets_dir: 'out'
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: 'Upload frontend assets'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         with:
           name: NNS frontend assets
           path: |
@@ -538,7 +538,7 @@ jobs:
     if: ${{ always() }}
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./.github/actions/needs_success
         with:
           needs: '${{ toJson(needs) }}'