fix: pin GitHub Actions to SHA for supply chain security

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

Author: 2 people

.github/workflows/ci.yml

@@ -16,10 +16,10 @@ jobs:
           - 25
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Java ${{ matrix.java }}
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           distribution: 'temurin'
           java-version: ${{ matrix.java }}
@@ -37,7 +37,7 @@ jobs:
 
       - name: Upload photon jar artifact
         if: matrix.java == 21
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: photon-jar
           path: target/photon-*.jar
@@ -48,10 +48,10 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Java 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           distribution: 'temurin'
           java-version: 21
@@ -63,7 +63,7 @@ jobs:
       - name: Get Photon version
         run: echo "PHOTON_VERSION=$(./gradlew -q properties --property version | grep '^version:' | awk '{print $2}')" >> "$GITHUB_ENV"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           repository: osm-search/Nominatim
           path: Nominatim
@@ -72,7 +72,7 @@ jobs:
         run: echo "cache_key=$(/bin/date -u "+%Y%W")" >> "$GITHUB_ENV"
         shell: bash
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
             path: |
                Nominatim/data/country_osm_grid.sql.gz